Red Hat Product Errata RHSA-2020:0962 - Security Advisory
Issued:
2020-03-24
Updated:
2020-03-24

RHSA-2020:0962 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

Security Fix(es):

  • The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887)
  • libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)
  • libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)
  • undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 6 x86_64

Fixes

  • BZ - 1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
  • BZ - 1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
  • BZ - 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
  • BZ - 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.src.rpm SHA-256: a5d827054857d9dfc96dae64da6a36a03764955dff9a856ba5edfbb7143a5182
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.src.rpm SHA-256: 02db97949c5a278d349c7183d0a2ad68f45ac4ab953f97da0a9248fe108cbeb0
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.src.rpm SHA-256: 853264d328bf536efd11419470a8a7d1ac6c584b62ab42db057a143e768bfbd5
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm SHA-256: fa0656f7adf260176b27d63fdd22d076777f125aff5d7fc264cc929f4e223c2d
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm SHA-256: 341d227a1458f3e56e6a4fcbc8e2666f025de28bb2b32b3d50d920c5e30713a2
x86_64
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 7ad0a40cbf2ad566cd88245ff498b92554d4e0b5b8f7f131f364af1511125ea0
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: f66979d1d25f954b64df94958dce82c686874a634ef6cba785b499e04c6c8e84
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: dc3fe1a0cd74da1262fef774f383c8d684d69b78f48c329257e53659cddfbfa7
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 37f5b53e4f9df5d855049c7c0e698f7e6dd0cfa1304fbd86e8e453e4e588fc46
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.noarch.rpm SHA-256: 33bf179f702db59bc49bae1343c87d408879377baff7681f7a0b2df9b435523c
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1948ad4b850c1471c62a8653e257d6d76f9fa0d6ce3064a6e019f69f3b35cfce
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7b0de21a6e1214009b889fb9734bdf4e296b4c8bb0d14e41c9637d6e4409c74e
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm SHA-256: 8932fd6a6f2059c1c1aad045b9d59f1a9b2b3f256a082297c1fd6b43b43efd39
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm SHA-256: 4492e4597115f04f51b67fa77140c0d869be6d5200d4de0fda0c8d07f01b3ee8

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm SHA-256: 4cc8a0ea56ee44235fe6e5d9ab6b1e1dcec0fed09b8671f247c7f62ecf711ec1
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm SHA-256: 05457335927524d273d35c3d28a8bc462111964dd40aeed2778104946f125824
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.src.rpm SHA-256: 0051e0bd4ac072b2d5604bcff47945efebafd11307e31fce75d585619852b3c2
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm SHA-256: 10c8e03bc096dff0ece8608aabc8f30c9ebb0fc7df2848a501821db684ea4a9a
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm SHA-256: ae555ec447addde821580bf168fcf65cd32136d2a2bd710486c0d75aa168485b
x86_64
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: d0b53523be29d432e62e921dd10450232ee4b801c836eaa4a99624c207759a1c
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: 13bd421dcf8316a89bec0c2006b8383d44c8ccf7998c8f64a37c11080995facf
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: 600b06a4cc9f49b46644b44c24b69fa6ea5af71edbf34d9739d1a6e047fb3c3a
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: b46280b0ec061b2ba06f586d56f0a8caf57307c878821a42b43507d79113fcc3
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.noarch.rpm SHA-256: 83ea3a9a512576117bad7dde203ff0f956101d3c23a87aa11f234ba7ed54d135
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5fcf06ea3e8d867740804ddfe7b8dcbbee875a9a0e5eafd65440bbb38a19e934
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9c51d87f48133329ddafa30872fc2bb381c930b35957f30f330a057ddc496b3a
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm SHA-256: a75ffed87f57d955065cc884d50748932e3a7326d71af5d1c5036ae3a5912c54
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm SHA-256: c3b76f16e29504a226d57a5da66d751896c7c7b5d2ebc399d23ee7a1c7cebda5

JBoss Enterprise Application Platform 7.3 for RHEL 8

SRPM
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.src.rpm SHA-256: a5d827054857d9dfc96dae64da6a36a03764955dff9a856ba5edfbb7143a5182
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.src.rpm SHA-256: 02db97949c5a278d349c7183d0a2ad68f45ac4ab953f97da0a9248fe108cbeb0
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.src.rpm SHA-256: 853264d328bf536efd11419470a8a7d1ac6c584b62ab42db057a143e768bfbd5
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm SHA-256: fa0656f7adf260176b27d63fdd22d076777f125aff5d7fc264cc929f4e223c2d
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm SHA-256: 341d227a1458f3e56e6a4fcbc8e2666f025de28bb2b32b3d50d920c5e30713a2
x86_64
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 7ad0a40cbf2ad566cd88245ff498b92554d4e0b5b8f7f131f364af1511125ea0
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: f66979d1d25f954b64df94958dce82c686874a634ef6cba785b499e04c6c8e84
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: dc3fe1a0cd74da1262fef774f383c8d684d69b78f48c329257e53659cddfbfa7
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 37f5b53e4f9df5d855049c7c0e698f7e6dd0cfa1304fbd86e8e453e4e588fc46
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.noarch.rpm SHA-256: 33bf179f702db59bc49bae1343c87d408879377baff7681f7a0b2df9b435523c
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1948ad4b850c1471c62a8653e257d6d76f9fa0d6ce3064a6e019f69f3b35cfce
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7b0de21a6e1214009b889fb9734bdf4e296b4c8bb0d14e41c9637d6e4409c74e
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm SHA-256: 8932fd6a6f2059c1c1aad045b9d59f1a9b2b3f256a082297c1fd6b43b43efd39
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm SHA-256: 4492e4597115f04f51b67fa77140c0d869be6d5200d4de0fda0c8d07f01b3ee8

JBoss Enterprise Application Platform 7.3 for RHEL 7

SRPM
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm SHA-256: 4cc8a0ea56ee44235fe6e5d9ab6b1e1dcec0fed09b8671f247c7f62ecf711ec1
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm SHA-256: 05457335927524d273d35c3d28a8bc462111964dd40aeed2778104946f125824
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.src.rpm SHA-256: 0051e0bd4ac072b2d5604bcff47945efebafd11307e31fce75d585619852b3c2
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm SHA-256: 10c8e03bc096dff0ece8608aabc8f30c9ebb0fc7df2848a501821db684ea4a9a
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm SHA-256: ae555ec447addde821580bf168fcf65cd32136d2a2bd710486c0d75aa168485b
x86_64
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: d0b53523be29d432e62e921dd10450232ee4b801c836eaa4a99624c207759a1c
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: 13bd421dcf8316a89bec0c2006b8383d44c8ccf7998c8f64a37c11080995facf
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: 600b06a4cc9f49b46644b44c24b69fa6ea5af71edbf34d9739d1a6e047fb3c3a
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: b46280b0ec061b2ba06f586d56f0a8caf57307c878821a42b43507d79113fcc3
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.noarch.rpm SHA-256: 83ea3a9a512576117bad7dde203ff0f956101d3c23a87aa11f234ba7ed54d135
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5fcf06ea3e8d867740804ddfe7b8dcbbee875a9a0e5eafd65440bbb38a19e934
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9c51d87f48133329ddafa30872fc2bb381c930b35957f30f330a057ddc496b3a
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm SHA-256: a75ffed87f57d955065cc884d50748932e3a7326d71af5d1c5036ae3a5912c54
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm SHA-256: c3b76f16e29504a226d57a5da66d751896c7c7b5d2ebc399d23ee7a1c7cebda5

JBoss Enterprise Application Platform 7.3 for RHEL 6

SRPM
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.src.rpm SHA-256: 46ed3f0d9a95a798f8a55bb31f6f7eb1cbd3376c2efffe875029b2a298a4b5fe
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.src.rpm SHA-256: a282872e1892a732e29d3832b164fcfb1f1edcae5e6800fb39da31a5362d158c
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.src.rpm SHA-256: d324c131d250ce108681e22fe94783bd9bf4dd06685938f6fa3750a6e19a7d15
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm SHA-256: 738fb95fd15c745d9947ebf3fecd33290b1ea411d4b486349f83f62484bb7e34
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm SHA-256: 324f4dc48ba2f69618298daa28161a2d6e154ce60a9230ef633967893c76ab0b
x86_64
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: 32585222970ce5d8ffd3172230bc9fd302a4a0c2d184e4d96a309689d80b2747
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: 7a5a99834b3da9aaa516bcbc602a78832f9f2cd07d545e5aceb7463a220bb06f
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: 50b8543c3568d45190128d05723df4eaa6fd5ef9b7898c0e22bcab6323cb2730
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: 2962f351fcfe912ec0ac6fee08bcb7f255e06170f56ed749ac6d3ce3c845d044
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.noarch.rpm SHA-256: 942582be8939752b5daf43edf9cba617d56fb8d04800cd75bd7cea8ff0622d20
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm SHA-256: f1720342e5e14c56eae2619fd54ec25ba2b613fc24467c8955cd1424701bae26
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm SHA-256: ae6a83a8f759717df5e7dc7f5dbabc7a8b047eefa087ef85888a515956f61f30
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm SHA-256: 01d7eff75a7342a75519bab756bf4889ccea48b9e4906ffea8707d2eb67318e0
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm SHA-256: 2d9f571079cfcd8dd8817a9b40de280c90dd4c48b466dfcca384c99c0bfad732

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.