Red Hat Product Errata RHSA-2020:2063 - Security Advisory
Issued:
2020-05-11
Updated:
2020-05-11

RHSA-2020:2063 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.2 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This asynchronous patch is a security update for the Infinispan package in Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8.

Security Fix(es):

  • infinispan-core: infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods (CVE-2019-10174)
  • jsf-impl: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter (CVE-2018-14371)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.2 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 6 x86_64

Fixes

  • BZ - 1607709 - CVE-2018-14371 mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter
  • BZ - 1703469 - CVE-2019-10174 infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

JBoss Enterprise Application Platform 7.2 for RHEL 8

SRPM
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el8eap.src.rpm SHA-256: a058a4d6d243afa944bbd6fe1c7ecfb297c10f5ce53a6988401a930b1486d9fb
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: aaa96b9c244e4804f3d19c0f04a8cf785024af477ebb5b4a7a8ecea71fa1e738
x86_64
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el8eap.noarch.rpm SHA-256: a80973ad8f4c09c641a4b3ab0d16dfee949b7981bcabd6d93c7a451dcf74fdaf
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 003296dcadf09e44c145bbf0a168682b7a28858eda675bbfb36ba82583f805ca
eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 540fed2442a85b653f2f64c7ba7c8c619d4321aee17f98b3f0d7b66d6b932210
eap7-infinispan-cachestore-remote-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 5e0cfafb767b91248aad032cb3d71a288796a3d18299fc0cb39a75f30a739543
eap7-infinispan-client-hotrod-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: dcbb0b9f8c15383893b6eb959c9d41c3d5b44feeb978ec2ad4126a9ca33ce7a9
eap7-infinispan-commons-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 4174f90692f2649b85d9b4e2eccf40d31334548662810ba274de74e027358258
eap7-infinispan-core-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 357b2622e335176daface0e29342e6d92e0cc805e99a5e6ae27dfc6a2985aa6e
eap7-infinispan-hibernate-cache-commons-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: b4985dfd0e3512aecba379ca92b5954987b8cdef9cec28cd6a35774e1ce54bd6
eap7-infinispan-hibernate-cache-spi-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: bc99388e399cf6ca34041e7085cbb2757568be17daabb7d747f3e39f42781274
eap7-infinispan-hibernate-cache-v53-9.3.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: de0fe064d01800d9103c04110cf709f4af54a21bd2ae9b4d78672bfdc59cda2c

JBoss Enterprise Application Platform 7.2 for RHEL 7

SRPM
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el7eap.src.rpm SHA-256: 59ddf4c0ee1e38712778c7e739d4f4130be384cd4dc705d439d08629e732af81
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 96d2045caf265233b5bfd50a07c151be6cc20b2c93cd97e6e4b4c340ef542390
x86_64
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el7eap.noarch.rpm SHA-256: 2308210ab3c9c4ad0b97e1a8c1ba1cf41e4eb66191cdcc8971e4dee6f648de97
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: bd924aad68f4370ff51999a8f8d4869fea09fd938841d28b874bf03e80233c51
eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 82e165979cd75d7174fa4241ed26d8e241f65dc59e3ba8db77f53b412cc11dba
eap7-infinispan-cachestore-remote-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1f189f5398ec5438d7469b4ffff7fa457f18fd2dd4f1ce4bee0a52a7c7afab43
eap7-infinispan-client-hotrod-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 2c12b0eeb0c65283f52dd566950adb859746cf30035f7c048e25264911c8534e
eap7-infinispan-commons-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 35f60aa78585f20d2a5e9824fe13c25c04805ddafc8a9e71ea20f044e814e66e
eap7-infinispan-core-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e563a9c19571ce57d65d127f295df2938ad0622057263fce8c0bfaab2837fc4e
eap7-infinispan-hibernate-cache-commons-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 6e1d3fbe3a7012c4b201da9080c1666fcb62fdc26d22e98ac72642302e467338
eap7-infinispan-hibernate-cache-spi-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: eb32e45c7d5a50988f2d3a7b2397035128afb32cb1b3da199bfa1c9e6d149fc6
eap7-infinispan-hibernate-cache-v53-9.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 46d2cdb82dbecf75d22a3129403993831dbb0d15311b2483a41eae3ecea0c786

JBoss Enterprise Application Platform 7.2 for RHEL 6

SRPM
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el6eap.src.rpm SHA-256: 216bd8a8782a71b67767d0273fa8ccf8c9020a6ddc45d070cfe7e98d26f28616
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 9671d3a5d942e4f736d29a0e8945d18c9fba27db8e5cbc504fc9f0a5eb4a11c9
x86_64
eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el6eap.noarch.rpm SHA-256: 3ae507f539bf21d29f3348e78bf3ed1ac3b9572d5903cfae673ab9cc2e740c14
eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 630c14f542a6c203ecb8c2ab13ec49c9d0a1fe3ddd2a068de39e394514983240
eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 9c6cd6327651029961a02aa65dff5369be2c1516ab12aabcebfe812d2a7bd930
eap7-infinispan-cachestore-remote-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 29ae22e945623eceb9c52baead85cff2c7c2b52961c63fa50e69ee99f40ac2a9
eap7-infinispan-client-hotrod-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 680a40fd6232e39d6a6b286144b91db4ea269c00e23106046904b40fd68896c0
eap7-infinispan-commons-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 1409bc4d109241c6da9f2900192133402682cbf6641aa9d1230c4e3cc6a91c09
eap7-infinispan-core-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 1df1c88839d8ba8fb5bc69062f5b74ddb44a8a56b639dddcf32ba96d30c4eb08
eap7-infinispan-hibernate-cache-commons-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 1c4215cfccfb619bff974d44eb25542df2f00d2683bd5604761a00881a6d5bcd
eap7-infinispan-hibernate-cache-spi-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 88dc02353f40ede65650c218ee29eb82a8d7c887c82f1dbd6a3340b01f178e34
eap7-infinispan-hibernate-cache-v53-9.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 3f680e6a138efd03b6c41b6b1801398c3b9dce64904e097ba4f5605271a53306

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.