Red Hat Product Errata RHSA-2020:3142 - Security Advisory
Issued:
2020-07-23
Updated:
2020-07-23

RHSA-2020:3142 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.2 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This asynchronous patch is a security update for the Infinispan package in Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8.

Security Fix(es):

  • wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)
  • jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service (CVE-2020-14307)
  • jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.2 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 6 x86_64

Fixes

  • BZ - 1834512 - CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans
  • BZ - 1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
  • BZ - 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service

JBoss Enterprise Application Platform 7.2 for RHEL 8

SRPM
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: 2dd4d7185602e2fafa6018f4c10ed2e1d4a8c561bf9f1a9ab9543feaa26a1ba7
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el8eap.src.rpm SHA-256: eb4756d11c1084bb3483b17cb289668bbd6bc33326810c0ae3c02491dcff907f
eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 4b4d8cf9eba1d4a902eeb82abc5e9fe01962b8e3676ec4d363128469e79bd6cb
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 19505c54fabc364467844b7cfc6e50f2d5e918719bc56b3fcb38148eaa278b56
x86_64
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 93cf2370b8427ecffc8328867c04cfc048dce8c5da52bd7ffaa11283fd1dc8de
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: e19f6075257010c97dfc114c03005e97f659e2d28890c674743f15032dd58a88
eap7-wildfly-http-client-common-1.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 8b324cbca154dfb92a4abae5e17743bf90e903100dda58379bb49ea75fc668f9
eap7-wildfly-http-ejb-client-1.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: f710adf393e45bb80220fccf88906f2655a4178c4065bc2750d264c394572163
eap7-wildfly-http-naming-client-1.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 824c7a163f5c79875687d991106b5ef7f7c9a41503c018b3dddf2028793b5d42
eap7-wildfly-http-transaction-client-1.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: c25b5a171de5d6bbb7799ca485846a2c5c83fba7b085923fe2f5696a95e86b6d
eap7-wildfly-javadocs-7.2.8-6.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 5feab04d993cf708dfdd58c28a8968c10651919c25df18a348d91616058fffdb
eap7-wildfly-modules-7.2.8-6.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 5fff41b84cfe4fc9cca75928a17e18013712c54a3b68d7c8533de7938d852ac4
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 993a769c07768f1ea28e3b0de3d4d817d8fd721eb4b8a359283c83609b0d0eca

JBoss Enterprise Application Platform 7.2 for RHEL 7

SRPM
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: 741decae68e61a7fb102710449ccc9f0d5ea8de2ad8c3d7622e262ca6ed0c20d
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el7eap.src.rpm SHA-256: 2006ba1d2bbcf4985a3cf5fddffb8fd8b5e35994d814c23fa72872432650df5e
eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 21c27b47dde6db967dc0b6ce41a50c58086d8ed46d7a1e1c1f445f2c4df9d2a5
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 844f355f3b492f230ab4eeeffa2a22db7e68f68910d191a5fa6c78b5b6db9945
x86_64
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: 37200f0169eb06e85c16ffc9baddf24f16d65c00d0be50a0dab610e5d59a21c6
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: f330a8c13381bc68e729f17adf0b1f1182494e954cc2eebf4e5e2376f7fe61cb
eap7-wildfly-http-client-common-1.0.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: f299069605d321d860a3bec2d93058763199517426ad7dbd2de52d925f7c34be
eap7-wildfly-http-ejb-client-1.0.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 2864e97056aea967127a742670cbc11a04eaa0bfd03693913ec3c904b44104a1
eap7-wildfly-http-naming-client-1.0.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: aef654143332ddb3de678cf845f8bb08c749deb392040ecc6408dced179d892a
eap7-wildfly-http-transaction-client-1.0.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 697f6e00d2bb1b5adba53aba22a486a6a5f3e672609da030260f258b9f3ac0c8
eap7-wildfly-java-jdk11-7.2.8-6.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 83edda6b27651ab59f554347e052fa46add8c2b1f87a5e3e79ab08327edf0c46
eap7-wildfly-java-jdk8-7.2.8-6.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 9bb05c01faf3fca526e5bbddad25c124d0ad6e8bd39c140adee9b74a3e883781
eap7-wildfly-javadocs-7.2.8-6.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: e99c63581f4b4ef0060d9cb9fca7e55de6ef5523be488a8f8be4270db9220098
eap7-wildfly-modules-7.2.8-6.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 9d869ba5035cdb1da28516e89dc7ad49e91bb80ca9341cf25b2708c1bcae6cfd
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 57ddcdce31a83257aef2732cd9c724746bc57474ebfab00b57b7eacec7117289

JBoss Enterprise Application Platform 7.2 for RHEL 6

SRPM
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap.src.rpm SHA-256: 8198db34db54eb9278815b631c000a9e9307925e702c2a5771cf57b00a06fc0a
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el6eap.src.rpm SHA-256: a9ba5a4da633b1537fc45c0fe9da470d8d09d667eef11a1ee7da36079ecb0695
eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: be25715159f8146833575841d6db158f99acc04fa255558e097169121651ba62
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: af22e1c1e6e403e1f3e44bcf6368f7e9ceacc55e29cdcf38c3759a8f54e0a260
x86_64
eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap.noarch.rpm SHA-256: d913203f9836b210089b32331f97b2cd156458f0aac03e062057149024b672c3
eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: f4de792d49e659990ed900b6e751225e8f07f806057a7f38ff558160aed813af
eap7-wildfly-http-client-common-1.0.21-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: dd626be1f2555a62b373e6b90604cec1d7832b2b1f65a2128c3bb87e7bedcd0a
eap7-wildfly-http-ejb-client-1.0.21-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 17b5f64b51179a054ccab812b0a65df2d264998b4bf807700a4672a511753308
eap7-wildfly-http-naming-client-1.0.21-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 2582384bb0901dc750bd2937aa9c6fe3b1518f6d094973a63724bc0dbe684312
eap7-wildfly-http-transaction-client-1.0.21-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 958d87bab4095257a4864d46497a6dcc2467b5f96be1f6056ad85b33221f87a8
eap7-wildfly-javadocs-7.2.8-6.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: f80edebeaf956ee9e8cf03d28a3b6902d1b865be8992073f876b975bb7fe0344
eap7-wildfly-modules-7.2.8-6.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: ee8f62949fbf252839c5cb4d2f18574b7b2dae014e77212848ad7cb82153c8f5
eap7-wildfly-naming-client-1.0.13-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4a2803947899a79634193fbf3f41260c3ef4275d52130dd40ec55960d0ce114f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.