Red Hat Product Errata RHSA-2020:3730 - Security Advisory
Issued:
2020-09-14
Updated:
2020-09-14

RHSA-2020:3730 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 6.4 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 6.4.23 includes bug fixes and enhancements, which are documented in the Release Notes document listed in the References section.

Security Fix(es):

  • jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS (CVE-2020-14384)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

All users of Red Hat JBoss Enterprise Application Platform 6.4 are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 6.4 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 6.4 for RHEL 7 ppc64
  • JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
  • JBoss Enterprise Application Platform 6.4 for RHEL 6 ppc64
  • JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
  • JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
  • JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
  • JBoss Enterprise Application Platform 6 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 6 for RHEL 7 ppc64
  • JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
  • JBoss Enterprise Application Platform 6 for RHEL 6 ppc64
  • JBoss Enterprise Application Platform 6 for RHEL 6 i386
  • JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
  • JBoss Enterprise Application Platform 6 for RHEL 5 i386

Fixes

  • BZ - 1875176 - CVE-2020-14384 jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS

JBoss Enterprise Application Platform 6.4 for RHEL 7

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.src.rpm SHA-256: 5daaaa715d02a2975f5e8a550d393402391b03dd3cd7dffbdb189f111d418b7f
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.noarch.rpm SHA-256: a39ef275b9163d125eb66aaa60ccbd1382559c1f64d90c4709550a4d1df7187e
ppc64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.noarch.rpm SHA-256: a39ef275b9163d125eb66aaa60ccbd1382559c1f64d90c4709550a4d1df7187e

JBoss Enterprise Application Platform 6.4 for RHEL 6

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.src.rpm SHA-256: 99ce3adf11575a63052889b3f9d4a8e45531e255fc38d9cdea5f8f4938539d0f
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae
ppc64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae
i386
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae

JBoss Enterprise Application Platform 6.4 for RHEL 5

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.src.rpm SHA-256: e11d28ee44784a8f9737126b3aaf2d03db493122c868c8a6d27a6c772b0f555a
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.noarch.rpm SHA-256: c5595b35a9868753fbcb33f0adbe6f0ee040c2e370d09e702b8ad70d21587594
i386
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.noarch.rpm SHA-256: c5595b35a9868753fbcb33f0adbe6f0ee040c2e370d09e702b8ad70d21587594

JBoss Enterprise Application Platform 6 for RHEL 7

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.src.rpm SHA-256: 5daaaa715d02a2975f5e8a550d393402391b03dd3cd7dffbdb189f111d418b7f
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.noarch.rpm SHA-256: a39ef275b9163d125eb66aaa60ccbd1382559c1f64d90c4709550a4d1df7187e
ppc64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el7.noarch.rpm SHA-256: a39ef275b9163d125eb66aaa60ccbd1382559c1f64d90c4709550a4d1df7187e

JBoss Enterprise Application Platform 6 for RHEL 6

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.src.rpm SHA-256: 99ce3adf11575a63052889b3f9d4a8e45531e255fc38d9cdea5f8f4938539d0f
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae
ppc64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae
i386
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el6.noarch.rpm SHA-256: e8dc1cd17d234e7667a10483d8c6cdb5fd469053d0818958094581b8e5e7ecae

JBoss Enterprise Application Platform 6 for RHEL 5

SRPM
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.src.rpm SHA-256: e11d28ee44784a8f9737126b3aaf2d03db493122c868c8a6d27a6c772b0f555a
x86_64
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.noarch.rpm SHA-256: c5595b35a9868753fbcb33f0adbe6f0ee040c2e370d09e702b8ad70d21587594
i386
jbossweb-7.5.31-3.Final_redhat_3.1.ep6.el5.noarch.rpm SHA-256: c5595b35a9868753fbcb33f0adbe6f0ee040c2e370d09e702b8ad70d21587594

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.