RHSA-2021:0295 - Security Advisory

标题

An update is now available for Red Hat build of Thorntail.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

描述

This release of Red Hat build of Thorntail 2.7.3 includes security updates, bug fixes, and enhancements. For more information, see the release notes listed in the References section.

Security Fix(es):

• resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling (CVE-2020-25633)
• wildfly: resource adapter logs plaintext JMS password at warning level on connection error (CVE-2020-25640)
• wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller (CVE-2020-25689)
• undertow: special character in query results in server errors (CVE-2020-27782)
• wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section.

解决方案

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.

受影响的产品

• Red Hat Openshift Application Runtimes Text-Only Advisories x86_64

修复

• BZ - 1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling
• BZ - 1881637 - CVE-2020-25640 wildfly: resource adapter logs plaintext JMS password at warning level on connection error
• BZ - 1893070 - CVE-2020-25689 wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller
• BZ - 1901304 - CVE-2020-27782 undertow: special character in query results in server errors
• BZ - 1904060 - CVE-2020-27822 wildfly: Potential Memory leak in Wildfly when using OpenTracing

CVE

• CVE-2020-25633
• CVE-2020-25640
• CVE-2020-25689
• CVE-2020-27782
• CVE-2020-27822

参考

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.7.3
• https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.7/html/release_notes_for_thorntail_2.7/