Issued:
2021-07-13
Updated:
2021-07-13

RHSA-2021:2694 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform 7.3.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • netty: Request smuggling via content-length header (CVE-2021-21409)
  • wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 8 x86_64

Fixes

  • BZ - 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header
  • BZ - 1948001 - CVE-2021-3536 wildfly: XSS via admin console when creating roles in domain mode
  • JBEAP-21180 - Tracker bug for the EAP 7.3.8 release for RHEL-8
  • JBEAP-20264 - [GSS](7.3.z) ISPN-12787 - Non Transactional Cache needs to be invalidated after commit on JPQL update/delete operation
  • JBEAP-20503 - [GSS](7.3.z) WFCORE-5185 - Update ProviderDefinition to use optimised service loading API
  • JBEAP-20623 - [GSS](7.3.z) Upgrade Hibernate ORM from 5.3.20.Final-redhat-00001 to 5.3.20.SP1-redhat-00001
  • JBEAP-21406 - [GSS](7.3.z) Upgrade Ironjacamar from 1.4.30.Final-redhat-00001 to 1.4.33.Final-redhat-00001
  • JBEAP-21421 - (7.3.z) Upgrade Infinispan from 9.4.22.Final-redhat-00001 to 9.4.23.Final-redhat-00001
  • JBEAP-21434 - (7.3.z) Upgrade wildfly-http-client from 1.0.26.Final-redhat-00001 to 1.0.28.Final-redhat-00001
  • JBEAP-21435 - (7.3.z) Upgrade Elytron from 1.10.12.Final-redhat-00001 to 1.10.13.Final-redhat-00001
  • JBEAP-21437 - (7.3.z) Upgrade netty from 4.1.60.Final to 4.1.63
  • JBEAP-21441 - (7.3.z) Upgrade Undertow from 2.0.35.SP1-redhat-00001 to 2.0.38.SP1-redhat-00001
  • JBEAP-21443 - (7.3.z) Upgrade jberet from 1.3.7.Final-redhat-00001 to 1.3.8.Final-redhat-00001
  • JBEAP-21444 - (7.3.z) Upgrade wf-core from 10.1.20.Final-redhat-00001 to 10.1.21.Final-redhat-00001
  • JBEAP-21567 - [GSS](7.3.z) Upgrade HAL from 3.2.14.Final-redhat-00001 to 3.2.15.Final-redhat-00001
  • JBEAP-21582 - (7.3.z) Upgrade remoting from 5.0.20.SP1-redhat-00001 to 5.0.23.Final-redhat-00001
  • JBEAP-21739 - (7.3.z) Upgrade elytron-web from 1.6.2.Final-redhat-00001 to 1.6.3.Final-redhat-00001
  • JBEAP-21977 - [SET](7.3.z) Update product CP branch github template

JBoss Enterprise Application Platform 7.3 for RHEL 8

SRPM
eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 92146dc6fb158e91b49368f61de3ccd80a2007f7a7f2f4d8e627ef88894dfea6
eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 07714ad3cb040b7aee4e74cb6cf7e2e1d2bb0f77c180098d678d463022dd1843
eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: 7b7dcaaeb7de57052301c244185dcbe1ac575be736fb13c0a5db74726862dbb3
eap7-infinispan-9.4.23-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 24eeb7b5351db370bf6128111a4a96a03616865488b982ef9da3544fdcbf5004
eap7-ironjacamar-1.4.33-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 46a3da756d45840e051257bbd8f1c11edbb7e9b0e8bddac5672279b459d3f2fd
eap7-jberet-1.3.8-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 9d0d8d7cd07e867bd2a677bd28d42df87aa86e14e91cf2be6aa3ca194ed6de07
eap7-jboss-remoting-5.0.23-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: d6c81be282bb5150fac9489a2dcede53c79ff0f940b29684699777c796b5cf12
eap7-jboss-server-migration-1.7.2-7.Final_redhat_00008.1.el8eap.src.rpm SHA-256: 153f9f2d5f90a9abe436e877bbe708b943b8a29fd934ed8c0baff9f242bb8de0
eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 109bc213fbc15bed9029d129360a9e6c3b661715e3d6e574dc65cd724b3b7af7
eap7-undertow-2.0.38-1.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: 547b09440321ffc1c2a30ab74b4b4c7bc5d442192b538602a49ab17309f48b98
eap7-wildfly-7.3.8-1.GA_redhat_00001.1.el8eap.src.rpm SHA-256: fe707424ff9f5d51b280e8cde46d5378cf3518b78a439a9a49da34a933199eba
eap7-wildfly-elytron-1.10.13-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 934921cd0548780bfb4f2d1be009df638dd1bb678ac131bd4a84e12c30437b09
eap7-wildfly-http-client-1.0.28-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: d101bfbcc9ba4d7b2f6fbd3da8c0051e28650bf69efae7a83c07c5ad756683df
x86_64
eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d9cbdd6b85e99c94d8e87286308a6f274ef7d642119563cb5ddc6baefa264850
eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 4ea6f07641e256d5278ddfb4ac034e29bcf2388799ceb3eefe6e27e797858033
eap7-hibernate-core-5.3.20-3.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: cea7614ce125536b9aff8b1d8bd83a407732cc90c8a99f382ec2d96114691731
eap7-hibernate-entitymanager-5.3.20-3.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 8e369ac77915c0f75ecf5389d2bc99cf4aa5c518a300eb7381a9cdf0a8cbcc5c
eap7-hibernate-envers-5.3.20-3.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3ba6687ea429dae101e1ef405c6f76ee60600fb9cf82a34131de824b76ef358e
eap7-hibernate-java8-5.3.20-3.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: a909ee7deca808b9acebf6c890d2668f9ddc644c50892e0e4c76a1fc740fb3d0
eap7-infinispan-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d08c9e08001a651d7d6d2be2f3b5626a32b239c0dff9d171619ba40a5b49d0c6
eap7-infinispan-cachestore-jdbc-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 602cf8534eec434d317177f663f558c73e46a22e09320387b4f0908dc81b09f6
eap7-infinispan-cachestore-remote-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1406f0891103b19764af6982d3e8268a54c3b65c1062b8b5a6a1a353d4c9130c
eap7-infinispan-client-hotrod-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: ddf262b84d5bff482bf741fc1e4eb527147089c8a57dde33a888fa31dc22fece
eap7-infinispan-commons-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 381194f70bc974fee462a0e625f379ac42dcee4d4d5cbab2dce1e4e4b3d706be
eap7-infinispan-core-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: e9dbe569a3dc01dced059bd199f0e913e3cb84eb86e9ab953e5edcd4fe6846f1
eap7-infinispan-hibernate-cache-commons-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 9eb5ea9f392d63e231bcc3f098de3203d54ce876584fa58a53454080a6e5665d
eap7-infinispan-hibernate-cache-spi-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 265527c7191667b7df7bc5053d5160d9c88f8318bce4a3ebe24151bcda4d8482
eap7-infinispan-hibernate-cache-v53-9.4.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 84ae8721cb60d7288532bd1cb7b9b303503c9222878de17befa5277993f11fc7
eap7-ironjacamar-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d96208ec9ca377a86753b5bde7b7910996b101a0374c96418e186c808665b352
eap7-ironjacamar-common-api-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 945cac8667c386bb5eb2b384a140043baab28a6e32b30b5d041aff3fccc38820
eap7-ironjacamar-common-impl-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 743fa212e8e43c3db1ca3b65c22645095e1d39e4cc2ab9b20ec4320a09e3da3d
eap7-ironjacamar-common-spi-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: e48519d5c10f8e9842f65217b578b6a08f27e18681177d82f08a63ae950712c4
eap7-ironjacamar-core-api-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7221c0607114e725e9eae57363040b28fe3aa4db8e6d79e9c49790a7fe499f32
eap7-ironjacamar-core-impl-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 8a0d344eeae53d0829a8cc50421daf7454941907c52266538e1c90d0945df250
eap7-ironjacamar-deployers-common-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 49bf4007a47af2370e6f349248325c30d5a92612f23e2d68b5aa2df7978972a6
eap7-ironjacamar-jdbc-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1eca9ef9d8a785cad8372374161f39dc87a96c9e9cfb930a3e8b12e36af722b6
eap7-ironjacamar-validator-1.4.33-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 6e2aa37b41c57e12bc3c18ecdbf069e5cf09ca77c49d064cb5df04a7a70faebb
eap7-jberet-1.3.8-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: f21056ba196d25d04038dc0d5e6040467dc664ad2c56dbb525a8d274a7b62356
eap7-jberet-core-1.3.8-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2a569fe002f2efd1759e4e391ad5f71735f959804fe51a0233c3471434787cde
eap7-jboss-remoting-5.0.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: de66c71164c44db72d583cf0b3ecaf3ade94cd648d07b5775994583ca3e094a4
eap7-jboss-server-migration-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: e58ef0d303bffba83bd8a9834f9fa7e9378e7f9bef35f8c95196ed84d0ba001d
eap7-jboss-server-migration-cli-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 261fb1d624a13f61dbe7e52c074b765544e3e45078ea024c773dc6fbe14b8ebe
eap7-jboss-server-migration-core-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: bc33ad9a67d3968eaa162c72efe80c0e08a18b2b07cf1e3d25b6b720474537bb
eap7-jboss-server-migration-eap6.4-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 9a5b3574765f0a2e54daa139dc0e22d377fa2fd42aff26e468e78292200245f7
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: d47c0ad375852cf88cb06d83700ae8d88a8a5de2f49d8a062d3ac416d61fbbb1
eap7-jboss-server-migration-eap7.0-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: a7798188f6926fb7dab0f776c1c2245ed1e8999626b2fa5fcb3f251b2ff7864c
eap7-jboss-server-migration-eap7.1-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 7b10a7612df7cc0a726b75690153ec923f5a6c0a938e2a20ed1db003814fc93b
eap7-jboss-server-migration-eap7.2-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: bfd19c75370f51be0cfe0cee5ed0b025dfeb97ffa74fe8cc7c0c0669deed4208
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: c07ee188832645e0335211495a3390ec9f655d1cb925813f4f16c0fcfc723bf5
eap7-jboss-server-migration-eap7.3-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: fa8fc53cf631909e4e00e19b3d9fc8752e1a3c47fcb3c756aa104b7833196b2d
eap7-jboss-server-migration-wildfly10.0-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 98d7e31013323e55f81e3b83451352b2f1d3bb4b51d290eb975407a654279584
eap7-jboss-server-migration-wildfly10.1-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 2fe8c455823da567e93039d732172e9f188f973e1121dca28f3bd8d2dea54e48
eap7-jboss-server-migration-wildfly11.0-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 25a02b9c1b1e213ccbd493c4722219519a15b93ecc45a2097d936183e177cf78
eap7-jboss-server-migration-wildfly12.0-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 8a7e9e45a07429e13eac8be424b0e9a1f2e4296b299242d76172d8114e8e9f97
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 49c010d2095a26e2ee6f47601eb00f3b6c76753dd878435dc5f19138712b94c3
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 96d672691fe55a018e45b0d79499dbbf0483128792361d4a1613b0fda51b3d5f
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 9646764495cca12811491194a81ea427870a049115ed48198356f043adc22b72
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 74a99552ea6c44d722349adc76a8aefa9672a3492dc41cace5a08f035da0dd4b
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: 613e8c567115c04fd9057db6ab20027fb489f68057dc1034009d87aff7e61b63
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: b0df720c17e5b3d33449e9f643acdf10fd7d13e88f96cc8fc65f458cc20d3b76
eap7-jboss-server-migration-wildfly8.2-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: e2e4a34ce1871330134c402ae3b874106f0a98b66053aeb7bd597b4ddd11f742
eap7-jboss-server-migration-wildfly9.0-1.7.2-7.Final_redhat_00008.1.el8eap.noarch.rpm SHA-256: bc55d41bf21f159fe78b30ea5bc27570cfde8f8d66da7736667ab83644871c52
eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 00c27465ea659af5b0ac24142f4c76bd9d4c2c0a6c4a9fc8df99601a301a2957
eap7-netty-all-4.1.63-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 266183af649fd2aa0acf56236f5ddb2cdae26e051cd3f79c6fb99553c800a3fe
eap7-undertow-2.0.38-1.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 93c3f4dcb8f72f30596be97d3b6bbd209ab6fe55a921998328fc69de04af1ff3
eap7-undertow-server-1.6.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: b566c23f62928c29f017a652efe5c4d6fd0d32cb4c0281289d596ab2aac7ca02
eap7-wildfly-7.3.8-1.GA_redhat_00001.1.el8eap.noarch.rpm SHA-256: e908aec28e6c45da7132f08b1c1908df3290a89da5411e6c8f8879d1b86e4c66
eap7-wildfly-elytron-1.10.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1f9ccbb8ab04cfa3d35a07244a058e2bde152ab5b787287b40e1e4074206b16f
eap7-wildfly-elytron-tool-1.10.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: da208ecbb1d8714f023e3e7ac9341f369ce2fc1dfa6c0ba9f8b81c3d8d88fc7a
eap7-wildfly-http-client-common-1.0.28-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 50234b9d44b37dfe7b7bbe97666e5901dc49d433053ab0aeb2fab4667b001d48
eap7-wildfly-http-ejb-client-1.0.28-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: e26552472b0276d6a614902219391b9c34f45542ca1ba6e6db6b094114eaedb1
eap7-wildfly-http-naming-client-1.0.28-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 29e021e09ac7d867dac8a3c1902d27cf97b66ef8e909ede74c130c9a558d95bb
eap7-wildfly-http-transaction-client-1.0.28-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: a8268b57fdde06f4ee8ddd83a990943bce8e8fc95b7fc018a657c035af010555
eap7-wildfly-javadocs-7.3.8-1.GA_redhat_00001.1.el8eap.noarch.rpm SHA-256: b00ed21d27d8d6c0db920f8169596e08db0d04a929501b3487c611f842808e60
eap7-wildfly-modules-7.3.8-1.GA_redhat_00001.1.el8eap.noarch.rpm SHA-256: 41ad1059a35bf770494da99dad34d5d0512f667ec97cdad7d30aa4611d74e1c0

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.