Red Hat Product Errata RHSA-2021:3466 - Security Advisory
Issued:
2021-09-08
Updated:
2021-09-08

RHSA-2021:3466 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This release of Red Hat JBoss Enterprise Application Platform 7.3.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
  • undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)
  • jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
  • apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)
  • wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 6 x86_64

Fixes

  • BZ - 1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
  • BZ - 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
  • BZ - 1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS
  • BZ - 1976052 - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression
  • BZ - 1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
  • JBEAP-21466 - Tracker bug for the EAP 7.3.9 release for RHEL-6
  • JBEAP-21115 - (7.3.z) Upgrade wildfly-transaction-client from 1.1.13.Final-redhat-00001 to 1.1.14.Final-redhat-00001
  • JBEAP-21958 - [GSS](7.3.z) Upgrade HAL from 3.2.15.Final-redhat-00001 to 3.2.16.Final-redhat-00001
  • JBEAP-22003 - [GSS](7.3.z) HAL-1753 - The Locations table is not updated after changing the profile in breadcrumb navigation
  • JBEAP-22029 - [GSS](7.3.z) Upgrade wildfly-http-client from 1.0.28.Final-redhat-00001 to 1.0.29.Final-redhat-00002
  • JBEAP-22079 - [GSS](7.3.z) Upgrade ironjacamar from 1.4.33.Final-redhat-00001 to 1.4.35.Final-redhat-00001
  • JBEAP-22085 - [GSS](7.3.z) Upgrade PicketBox from 5.0.3.Final-redhat-00007 to 5.0.3.Final-redhat-00008
  • JBEAP-22138 - (7.3.z) Upgrade Narayana from 5.9.11.Final-redhat-00001 to 5.9.12.Final-redhat-00001
  • JBEAP-22159 - (7.3.z) Upgrade jakarta.el from 3.0.3.redhat-00002 to 3.0.3.redhat-00006
  • JBEAP-22195 - (7.3.z) Upgrade commons-io from 2.5.0.redhat-3 to 2.10.0.redhat-00001
  • JBEAP-22198 - (7.3.z) Upgrade WildFly Core from 10.1.21.Final-redhat-00001 to 10.1.22.Final-redhat-00001
  • JBEAP-22200 - (7.3.z) Upgrade Undertow from 2.0.38.SP1-redhat-00001 to 2.0.39-SP1-redhat-00001
  • JBEAP-22204 - [GSS](7.3.z) Upgrade jberet from 1.3.8.Final-redhat-00001 to 1.3.9.Final-redhat-00001
  • JBEAP-22227 - [GSS](7.3.z) Upgrade remoting from 5.0.23.Final-redhat-00001 to 5.0.23.SP1-redhat-00001
  • JBEAP-22317 - (7.3.z) Upgrade Undertow from 2.0.39-SP1-redhat-00001 to 2.0.39-SP2-redhat-00001

JBoss Enterprise Application Platform 7.3 for RHEL 6

SRPM
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap.src.rpm SHA-256: c7fc3ddfc9f5ab1770c487554b4b770b06c5cb0f9ecdc7d2cf7dffc5ad6afd20
eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 1a533db69619a8f497d814dcefcb871315008be60df843cc80fff266c882f867
eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap.src.rpm SHA-256: 27be2a92e5ae8190d52e94da1c29b39cc45b06c6506ecc052cb86a8beb1ff7b2
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 102377b7001b11e986dcbbbad693ad3621fdf9696364f7ce99b6fb6a1a464ea6
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el6eap.src.rpm SHA-256: 49862f5311509b208f8c3765ccb7ebcb62fde2a2c93eed82644e1dc81095d933
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 8617579a90215e5e0f1e7f45fc41a485bcdf15a885a0e00f60dc25102824a886
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el6eap.src.rpm SHA-256: 05691ae537f3b1f6f148f327b3ce4cea828361ece9b7dc02a331eed566473e65
eap7-jboss-server-migration-1.7.2-9.Final_redhat_00010.1.el6eap.src.rpm SHA-256: e51798599a1171da74f3e933309f0bb21aa966f4a6a33152c217f814a3d5fc57
eap7-narayana-5.9.12-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 51f49bb2198f9c8e5d08795daa66452c21b98837f812efe0770f780f7c459587
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el6eap.src.rpm SHA-256: 750eb1df303cca702e99bf7fd2661bc109918bb4ca749c56ad09f0f6c5461630
eap7-undertow-2.0.39-1.SP2_redhat_00001.1.el6eap.src.rpm SHA-256: b220c8590cb792bea22c0e34f7487affde0ee9823de8619f9a416b1f35a569c1
eap7-wildfly-7.3.9-2.GA_redhat_00002.1.el6eap.src.rpm SHA-256: 3f07352cd01047f11d20a762c04a9203aad332f9a09d6ad3369183f01fce1669
eap7-wildfly-http-client-1.0.29-1.Final_redhat_00002.1.el6eap.src.rpm SHA-256: 5be0c2ac920139fc3598853010b1c7addc15e5b8d0c37ba1f10dcc6fda049815
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el6eap.src.rpm SHA-256: a7f2d42c0b611d25c41e5b8c0973a2ccd735aabcfd1542d470fe7317ba6d2c56
x86_64
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 968acf12ab7b3b25f5f84fc9f7f954c80ecba6c086644a9a27b974e11488dfe7
eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 263ea6e29c0927921ef3299c1d56880f9af80979e8447e59017c6fbfe97daf46
eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: 6e7f941b244d1c214458c045495ee3101387211c5a8b087d242e71022af60f6b
eap7-hibernate-core-5.3.20-4.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: 154d176a02ebadb149e5648a41602edd05e129b353af8bd522abf8f5f981bfa3
eap7-hibernate-entitymanager-5.3.20-4.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: be4cff7038364fc0f3947b9e1c8b0c163dc0d26378c580aac15f38dd5321d2fe
eap7-hibernate-envers-5.3.20-4.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: 667cd2107ebebbed3ab2b79f02ff072d25d5b3d2e8dc40501ba3327795d08567
eap7-hibernate-java8-5.3.20-4.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: 41119339ae3e6eda697d297531e1030822bb08a6d925063e549dc9d61847a879
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: f8583351d0e14deaa34e012656cb20a4bf6af0d9c8cf63445f6cb00077e8d671
eap7-ironjacamar-common-api-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 496920460386c30b92a16f3bd922a2f0ee770ef0c35e9afc9c30ca9db95bfca2
eap7-ironjacamar-common-impl-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4bdab6f0b373f295c586ba7d8c69a78acdddf97f94ad2c59c3c780a4be5c0d59
eap7-ironjacamar-common-spi-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 9ccd105515eadd482fae0165434befb03f486ec50739e6329f0471dd68092750
eap7-ironjacamar-core-api-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: fa8fdfa65e01b7a0272d5368569a04283d11ecadd973de2172d828de8bc6210d
eap7-ironjacamar-core-impl-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 5ada979411dc3a50c2da7ffb23dd37054a2475f9cc29f1193776e4e7a81537a5
eap7-ironjacamar-deployers-common-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: a77d6b65fa0434fd199d0820f31f76d9c4f9cb708958f3fdde01c92ceebd96a2
eap7-ironjacamar-jdbc-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 9c911a491e332a7214a479072a5c0ff3e0c96647748c6b572144cc7cad36bdd7
eap7-ironjacamar-validator-1.4.35-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4a5762a3363544b086033ab94af4ff838815ee6b03e0d0eedb7caeda308d4a59
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el6eap.noarch.rpm SHA-256: 2ce0509b990a861774dec89b669efc978edfe9732f6ef4d274bbe7ef8294d9a3
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 48c92df0d7a87f367a533ccbbe0e9ad705e6ff072c5bddf4b503f691fdb4513f
eap7-jberet-core-1.3.9-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: c9a83c590c68b0b974f19da309e1205f74d2bf13dae5c1ba990c3ae8c17e826c
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el6eap.noarch.rpm SHA-256: b4d32bac247298e409c5f842ad14c7583e5946bdfae1a48371787ec9f46cd00d
eap7-jboss-server-migration-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 1424223dc4941c73afb0aed9d7ca3775ac855f02e1c14385e070e9b36f51974c
eap7-jboss-server-migration-cli-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 9b9ddbda7056148b80ea3a814199cd6368db0ead79a71c3534170b06130ac734
eap7-jboss-server-migration-core-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: ce9e85cbc88336b5e98fe27e2b2e95b3258201b9005cb2e5ee6955ce952f2b5c
eap7-jboss-server-migration-eap6.4-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 9d95af7b1dce370ca94a503e21358a9ee3df0a85b7ee75741eacdfc775b5aff5
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 57bf1e4db479b94c3572122709fc36ec49d41b2b1e3066027c0b862f6b05400e
eap7-jboss-server-migration-eap7.0-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 8445c4f15ab5031f70f49e50e00fd76c836ae5f7d921d45326a499ec993083d3
eap7-jboss-server-migration-eap7.1-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 66253b35c00f5b2ed7507b079fa401c8c18207d1b71f7d1512979b604ba6754d
eap7-jboss-server-migration-eap7.2-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: f5923d9e295e97017a8648d00d3875b0e558550ecbea79652e22603c34a4909e
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 11bc4f2eefb9443ce724806c383196f56553a068cbd3d54501f6acf5e96140ff
eap7-jboss-server-migration-eap7.3-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 782bf99fe079854320d7e1ea915dbbf468c4ec97a01ff9b0e3a8aeeea01f2f97
eap7-jboss-server-migration-wildfly10.0-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 62800c32d74e2a924ba3af4d6033ab1d2b64ee67d3d890a63271f9425a40155b
eap7-jboss-server-migration-wildfly10.1-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: b49f0fb5bfc61c493735390b009a014fe8a70ce07791fbad9de798efecc2017b
eap7-jboss-server-migration-wildfly11.0-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: f810176f886f254f3f810868066526b0f85d942265e6fcd4495ffeda689b3ba5
eap7-jboss-server-migration-wildfly12.0-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 1790cf5616c7860653040468b1d88812fe722acc75971b90fe55be1b9821c951
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 08e3587d6b103dbcc74de33177f1d3dfda83ff4db62f58dadacde3334aaee2ea
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 702a94a1529e0aea61bfbd1de8ef0e3f161224de5428f2b06b01c9866f9919f7
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 2f1ef5593a64106f8010123c96cb2c847e3fbab1feae179128e749b30f5b82f1
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 45695aa81fa3ac562d0f95478c8de83e6a8665a1bcea25ab5cf7ab7dadc07ca4
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 5e3f32dd90e7ed7cdabf1c9f7aa77d4caa032406895c52eb29cd2a90aae61336
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 80297ac3721142922285e841049161a1879f3e246b4e9df268283241472d1bf1
eap7-jboss-server-migration-wildfly8.2-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: e5b653717193d869c91c72685a83586473ff5c1f8193fa3fd7bf103400fc9759
eap7-jboss-server-migration-wildfly9.0-1.7.2-9.Final_redhat_00010.1.el6eap.noarch.rpm SHA-256: 8af104f2b14a2eae21d667e70664d195b7e6653e7305c70c3f122cc396ea3082
eap7-narayana-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 9aa07c8802b00ddbf1a515347cc06da8799a352f9ccadee15c358d53b69b0a97
eap7-narayana-compensations-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: d5090f91a18f86d3368b1fbbec816545c974bc70616de95809d169c242cff700
eap7-narayana-jbosstxbridge-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: bff2a4e7d7d8fbcbf43885412612c61b53f30d766336b9a012de3991b0fd96cf
eap7-narayana-jbossxts-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 59e495a89e2b54fcb2a97c9b8a3b99f7c504cc53b82e1a87b4f5628a0759860e
eap7-narayana-jts-idlj-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 44e461f42f0b2affffdb6ae88bf9788bac71cdbbf59a93c9b2e6467dae6d5a75
eap7-narayana-jts-integration-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4943fe89f10d6fb61ff0ace7f79e5a0c8f03051c01fc920e08985ab0454a0c98
eap7-narayana-restat-api-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 64f76083bc8b38c2a96b50ed0446fbbfe0ddf5d878e00017350bc817e7f4cd26
eap7-narayana-restat-bridge-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4ea977d62e443e77daee82a41cb2ae8f9528f47f4da940e3d8bca09c7d5ab9ea
eap7-narayana-restat-integration-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 6b46aedff632c2bbc8e0a497f97d25daed6babb2268b24680460c55ab49e4f37
eap7-narayana-restat-util-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 6733177a1387d3b0a6b2815aa37811a2dbf08d3d34fc20ccefb0276877519d02
eap7-narayana-txframework-5.9.12-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 9f1b590043c8fef3b7585ed8eb547d9406281492320756ad73368657c8fbe019
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el6eap.noarch.rpm SHA-256: 53941d7a66c74aba9448eb16c2b7f799c42beb2a1ce61022eb5a89b12123a3f6
eap7-picketbox-infinispan-5.0.3-9.Final_redhat_00008.1.el6eap.noarch.rpm SHA-256: 39e75dad5212069ef21d658d7f0e3676fb58e07bc9cbac661da54c6e031de88f
eap7-undertow-2.0.39-1.SP2_redhat_00001.1.el6eap.noarch.rpm SHA-256: 953e5aa59dcca5958a9cb7e87d3165fa56308445f933ec0c41e312d8e7cbb770
eap7-wildfly-7.3.9-2.GA_redhat_00002.1.el6eap.noarch.rpm SHA-256: 5a251c35b0a4439cc8074ba6e0e899d02164d33c6de06c5d6db102ee5a3701b5
eap7-wildfly-http-client-common-1.0.29-1.Final_redhat_00002.1.el6eap.noarch.rpm SHA-256: 56145faf7b17069152b8bcf8246c7d5e6d73d168366194447f44f386b521d580
eap7-wildfly-http-ejb-client-1.0.29-1.Final_redhat_00002.1.el6eap.noarch.rpm SHA-256: 71c1bc0633fc43ba4d6708e03a421d420bb5c553046693fe8df5066d2357b590
eap7-wildfly-http-naming-client-1.0.29-1.Final_redhat_00002.1.el6eap.noarch.rpm SHA-256: 0f3504606586e7175a08658ebfe19d7f5e9a0fa473a7be10bdc468bb804291b0
eap7-wildfly-http-transaction-client-1.0.29-1.Final_redhat_00002.1.el6eap.noarch.rpm SHA-256: 4bc896c49e5e9695b5ea68490c5b773577918c63de63c5d1f69bb9f7829a7e62
eap7-wildfly-javadocs-7.3.9-2.GA_redhat_00002.1.el6eap.noarch.rpm SHA-256: c39be047be733ee3fd169a866bd55555dc19c65fdad27494414ab89584f1f524
eap7-wildfly-modules-7.3.9-2.GA_redhat_00002.1.el6eap.noarch.rpm SHA-256: cb6e46bf3de623a705983625587a886f9dee78d8ebb9f3bb581f8f5ecdc71dc0
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 54640b6ecd24689aa617b7e43375ddadac13aa556d73066850e2128ca27d2f87

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.