Red Hat Product Errata RHSA-2020:4401 - Security Advisory
Issued:
2020-10-28
Updated:
2020-10-28

RHSA-2020:4401 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Security Fix(es):

  • jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (CVE-2020-25649)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 6 x86_64

Fixes

  • BZ - 1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el8eap.src.rpm SHA-256: da403455e437121bcf952381274adea493c7aaaead681cc9774314f945ba6228
x86_64
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: ddfe080694e55ad0ad2502cc3ef8c7ed40c2263f022b8b9a7ee564f3681830e4

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el7eap.src.rpm SHA-256: 861d7dfccb3851e093bbcd7a18c9732ac007286983b131b20a9288c5b23d7d88
x86_64
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: f76c2d8eb0c80c8b333a444d7366d56e524ff31bad0258556d6a088eea86597f

JBoss Enterprise Application Platform 7.3 for RHEL 8

SRPM
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el8eap.src.rpm SHA-256: da403455e437121bcf952381274adea493c7aaaead681cc9774314f945ba6228
x86_64
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: ddfe080694e55ad0ad2502cc3ef8c7ed40c2263f022b8b9a7ee564f3681830e4

JBoss Enterprise Application Platform 7.3 for RHEL 7

SRPM
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el7eap.src.rpm SHA-256: 861d7dfccb3851e093bbcd7a18c9732ac007286983b131b20a9288c5b23d7d88
x86_64
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: f76c2d8eb0c80c8b333a444d7366d56e524ff31bad0258556d6a088eea86597f

JBoss Enterprise Application Platform 7.3 for RHEL 6

SRPM
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el6eap.src.rpm SHA-256: 43ead008e52b711f23087f6bba3863d0d52d78d2d345a3c9188e65b2484d4192
x86_64
eap7-jackson-databind-2.10.4-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: a45118c817bdf2b37f56082676eaeaeb7d73c9d55c5c55bfbc95e9aabdf8c5fe

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.