Issued:
2021-09-08
Updated:
2021-09-08

RHSA-2021:3467 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This release of Red Hat JBoss Enterprise Application Platform 7.3.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
  • undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)
  • jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
  • apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)
  • wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 7 x86_64

Fixes

  • BZ - 1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
  • BZ - 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
  • BZ - 1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS
  • BZ - 1976052 - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression
  • BZ - 1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
  • JBEAP-21467 - Tracker bug for the EAP 7.3.9 release for RHEL-7
  • JBEAP-21466 - Tracker bug for the EAP 7.3.9 release for RHEL-6
  • JBEAP-21958 - [GSS](7.3.z) Upgrade HAL from 3.2.15.Final-redhat-00001 to 3.2.16.Final-redhat-00001
  • JBEAP-22003 - [GSS](7.3.z) HAL-1753 - The Locations table is not updated after changing the profile in breadcrumb navigation
  • JBEAP-22029 - [GSS](7.3.z) Upgrade wildfly-http-client from 1.0.28.Final-redhat-00001 to 1.0.29.Final-redhat-00002
  • JBEAP-22079 - [GSS](7.3.z) Upgrade ironjacamar from 1.4.33.Final-redhat-00001 to 1.4.35.Final-redhat-00001
  • JBEAP-22085 - [GSS](7.3.z) Upgrade PicketBox from 5.0.3.Final-redhat-00007 to 5.0.3.Final-redhat-00008
  • JBEAP-22138 - (7.3.z) Upgrade Narayana from 5.9.11.Final-redhat-00001 to 5.9.12.Final-redhat-00001
  • JBEAP-22159 - (7.3.z) Upgrade jakarta.el from 3.0.3.redhat-00002 to 3.0.3.redhat-00006
  • JBEAP-22195 - (7.3.z) Upgrade commons-io from 2.5.0.redhat-3 to 2.10.0.redhat-00001
  • JBEAP-22198 - (7.3.z) Upgrade WildFly Core from 10.1.21.Final-redhat-00001 to 10.1.22.Final-redhat-00001
  • JBEAP-22200 - (7.3.z) Upgrade Undertow from 2.0.38.SP1-redhat-00001 to 2.0.39-SP1-redhat-00001
  • JBEAP-22204 - [GSS](7.3.z) Upgrade jberet from 1.3.8.Final-redhat-00001 to 1.3.9.Final-redhat-00001
  • JBEAP-22227 - [GSS](7.3.z) Upgrade remoting from 5.0.23.Final-redhat-00001 to 5.0.23.SP1-redhat-00001
  • JBEAP-22317 - (7.3.z) Upgrade Undertow from 2.0.39-SP1-redhat-00001 to 2.0.39-SP2-redhat-00001

JBoss Enterprise Application Platform 7.3 for RHEL 7

SRPM
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap.src.rpm SHA-256: 89b8f29473958768bd9881e6d4b26ca1c44a360f222f521dda424f94a25dcc05
eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 0f0a6cdc7cc2c39340c5837d59884122fda01fc4aa4fe3b9a3f32921ddb378ca
eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap.src.rpm SHA-256: 5725cd3cf78a0e975b898611e281b74c1b1c8498a9dd1b2899f7c4b341ddd8dc
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 0766c5ea52d8a583c0a537832d9aa43eb5ebd0f0170413b09c9ea8357aea8102
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap.src.rpm SHA-256: 6a7b4565a07f98b7a3f5fbcb636b571da5af52d766f76421ec1983edeab20210
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: f32f5b7980f48af2c1bf2a0f3135435eaadbf6299a77585d10ae45b83792346d
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: 80c7fd58ac0aedf11106959a43e361c6a9edf41d4d5219f082280c67ed33c08f
eap7-jboss-server-migration-1.7.2-9.Final_redhat_00010.1.el7eap.src.rpm SHA-256: f94d272e6c211a3cead5d1192a94726e7459bdb2aa029842fdf9cfd909c83ad5
eap7-narayana-5.9.12-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: a3de9b7b1d93e119d6784dc92d85ebb0f2f2d35461f9a00c75bbf4bf6476f011
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el7eap.src.rpm SHA-256: f15524a4442da3a31a3aa67cfec651ff895f5d0cc1f95e2526bb3b7890c554ba
eap7-undertow-2.0.39-1.SP2_redhat_00001.1.el7eap.src.rpm SHA-256: 56fcdfaf1fc26d0482908b1f7897397a14725114a596e7beebfdfbf1760dd02f
eap7-wildfly-7.3.9-2.GA_redhat_00002.1.el7eap.src.rpm SHA-256: 90765e56f8f05505f88d295dcce6d036a34051e0b16f324902c71544b4b25612
eap7-wildfly-http-client-1.0.29-1.Final_redhat_00002.1.el7eap.src.rpm SHA-256: 08f30743f52df80d2b831a2edce84cfab56ee493e885ed0b11321f4c4a0f67da
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 5cb50c11d08db0ff0a86b3d544d0b83e922744d9b766f226a59c13f5513a12bd
x86_64
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: cba5a695e660cfb2bf03487a6fb611a90312fb50d31882c7a504e57ab44ffc58
eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5e9a4d464e1c8462178520dfb0aac38c13c8d81e5feb9547989ae37d901fc1b0
eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: 47e77a6cf7f61c0fe394a92daea0ea482aa533e11de74cd3389b31c87c97b036
eap7-hibernate-core-5.3.20-4.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: 8b1a0b09da464635c344b02c641b3caab09e943c8d0793169b225f96f8fa6881
eap7-hibernate-entitymanager-5.3.20-4.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: feb8984fc3784596148fb9fd2641243a61f151aa223ad89e05228cfe371a805a
eap7-hibernate-envers-5.3.20-4.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: 48123d69c981da2114369c79e12c91dadffd29996dd0045af3381c5c0632b2db
eap7-hibernate-java8-5.3.20-4.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: bd6a917cdcfabe9ad965fc4de6cd6a13f0c4ce1c7f156fff40dc6b0700a991d3
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e6c07b8dedae303fc3c38ce6f8dc9a837ce70118d3177958b82ffa073bfe583a
eap7-ironjacamar-common-api-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5829aee6768bb5aecdd372d9deef29cf466a2da5e2b2a15319211b9da1ea327f
eap7-ironjacamar-common-impl-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 764c2948e88d4d2c1c18ed295507284938910ac51b0d13886128b6d9104da2de
eap7-ironjacamar-common-spi-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: f171406b46cfc50338c4ff71c35046ef93f59364a2490a46734033a5c6f27d1e
eap7-ironjacamar-core-api-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b8284e3ee9d0866b4c2d04024539c3c8a252222b835696b17196cdd96d16211b
eap7-ironjacamar-core-impl-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1783f94962f779e6d3de9b45eb795b09ea4f534ed835d097edb1d1a587c91a63
eap7-ironjacamar-deployers-common-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9ca71cca23d0f38a6820bf0e3c43e7509d93c0edddc0d278b95edfcee9d6006d
eap7-ironjacamar-jdbc-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e8aa1bf3630bfd54a81feeba5adaa4fb2ec625220361730a24e56753600a93c2
eap7-ironjacamar-validator-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 439c9bb4984790b403e9838425f51f0c2e6f5e505d0aafe83dac3b25078db999
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap.noarch.rpm SHA-256: f621fcbd5f409d88e014e9b0be42ececbfe62a69cca66a5d9e934775f012688f
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 4f76ea1e808c7d636cd4d3e30ed59c1e5494d37497ead1e62e6c62306558d037
eap7-jberet-core-1.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b5de01a2a701549c3348b9e1e531596e3b936e4f695b6a52ec03559a05f58b8d
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: 3bc55fdd23a77efafff3305560a517f511ae305713d4c582e7cf843282ff8d1c
eap7-jboss-server-migration-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 85b628a2d88b49a668f15f9e01f0ec6dda1089fe824578c6876b20525c376087
eap7-jboss-server-migration-cli-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 8ffd418343fb465c66e924d416ad98eb49ac8858b5fd041721f92a3f8374c429
eap7-jboss-server-migration-core-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 0c0ef9e7c7230aac009427c775a879188c4b4478f9eb04e789e89ba90a0b3357
eap7-jboss-server-migration-eap6.4-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: e891a1eded0f705673f0b504349297c16f817d69d441580787080f3efcb16cf6
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: ff774a33d72e664b1c918a8ecbf70cdce40e7d490ad539308a15a3252fd8775a
eap7-jboss-server-migration-eap7.0-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 740588b62d870e65a2f9e1fda7fdb2b252b11d258bf3f687e8e5cb14f14677a7
eap7-jboss-server-migration-eap7.1-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 170bf16b007217929dda0948afc955c2215749092b94f72dfe2a754cba120044
eap7-jboss-server-migration-eap7.2-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 7a28213bc79bd24c47932c5f7f650ebca7dbe5034122b9869d17787d8a8c8f12
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 36b9751f3450d8740f1a0180b57df339c1266d4bbfcd39b5a668e1f5f2abeb8c
eap7-jboss-server-migration-eap7.3-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 46a2051741f2082fb6555a0640928a8c0545493fa760c3d5acbb73c140fd20dc
eap7-jboss-server-migration-wildfly10.0-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: d69ad97d6a7d4a3f17f8473643ce97652d1818b78e01954b656032d5df22f4fe
eap7-jboss-server-migration-wildfly10.1-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 81b4296b6aa7fb3732b35b7343c607a67be2f8ac039234a33cb9d3c2fddb6a7c
eap7-jboss-server-migration-wildfly11.0-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 06f842cdd8834297d4c5f5dbe8d6c9a9eddb303a3a2f2b96a995299e41f55591
eap7-jboss-server-migration-wildfly12.0-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 525524ea623ebebbfa6c485adee89feef27b1995e01363933c791b6b45596621
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: d7b9e1adacbc65b751bcfd414e5dbbd514f0efdb106057ab331946c22a273954
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 8afd3e20409ad6dc3e70362a1ea6e095fd7483d1c8eba7f3f059d2e871d14bb2
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 79117dc845b9b8d991bd8592c7b1deb942aea83d3815ce0b320372849b8db9c8
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 1cc90309ccfe898edea98a5442fe67178485d69a04905c8e3ce3583db26cf0d6
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 2e9e35a5a922b839b045f8f491e121dbe57b29cea3d5b412812f19fababfa6ee
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: e5c65ceccfa55c38454b768918c1c0902054e2422c402e8ee53e99171eaabe61
eap7-jboss-server-migration-wildfly8.2-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: 2028cbc2f56dfac7be857bb297e475ba7d4691528ccc43b40c2206bf02483ed3
eap7-jboss-server-migration-wildfly9.0-1.7.2-9.Final_redhat_00010.1.el7eap.noarch.rpm SHA-256: a9a509b1d7e50834e6aa2e289fb03e877831b1512b8e92aa1352c728cffb39f3
eap7-narayana-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 7b8de13f1acb419ccb4c05d01b1624e281b372bfb1f283942fad7ad648e9782e
eap7-narayana-compensations-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1ea70edd33ad1abde61549925a594575feb64dfa2797ce9edd904520259aed34
eap7-narayana-jbosstxbridge-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 81dc43ddbd75b74580d4f3b65b80ed4dd7e7740312777d4702eed9eaa1e5b9de
eap7-narayana-jbossxts-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 763bab7deec06198de1f53f14be8ff1fdb401b7016680da6fd4fa008645c2e08
eap7-narayana-jts-idlj-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: d27e5b805a4cd04efa3324111ddad6288e8929d6b592e0620946586d6f98e0c8
eap7-narayana-jts-integration-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e90cf13c796d7dd5570faa2d6c2eaffc7d1db2ab05eacbedf0bbf318a42dc788
eap7-narayana-restat-api-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 627d195460cd16c0a562bb1b8c95977d895662bc67911f5fea5e4a4401ae558c
eap7-narayana-restat-bridge-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fa86b1c36879f4e9096424676b88d2e20f5f75413ed345ac2c8aba29c5aae071
eap7-narayana-restat-integration-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: d42d72ae80de833b3880addac870c0afd895e506e30e9c1bccc2d34f3e8d0be4
eap7-narayana-restat-util-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 2469df22da7796b8738ff932ee0c032945e966e47776ec2d69a0a6bdf1ca22e7
eap7-narayana-txframework-5.9.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fc63f1719c7d420cb2e34b776c425a3b59b7de5f41390dcd9410a9f9be87ac6b
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el7eap.noarch.rpm SHA-256: 4eb2234c28367354dafa0836885a92fe89af7a3c356dfa56350df38a581eb9bc
eap7-picketbox-infinispan-5.0.3-9.Final_redhat_00008.1.el7eap.noarch.rpm SHA-256: c3798ba6e91e1d2906332e1f94e051d60046484023972e1d6cfe99bb76bc3eb5
eap7-undertow-2.0.39-1.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: cce78189a2f681def4150e8554047a3a4410501fd862367de6e1bbc8a7a93626
eap7-wildfly-7.3.9-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: fade3aa0c82e3658ac97cc25628f80df3ae8d616449a203afdbb88ce6c509999
eap7-wildfly-http-client-common-1.0.29-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: 4b46d156dd3e8b8a91f8edaf2e1b81e713c5fc4dd81473b15931cc5e4188a51a
eap7-wildfly-http-ejb-client-1.0.29-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: e3859a5f0d6946376fa292e071aaa4535fb559bab6db0a626b00535806b7a901
eap7-wildfly-http-naming-client-1.0.29-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: 0565a8ab38ec380434a316f425f1bc78f327de76a89320f280e06a4e44734ec0
eap7-wildfly-http-transaction-client-1.0.29-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: df1438bc28df7fa6f3c0ee49fa6f004da524cab1528510c44de3fb2b7a1cebed
eap7-wildfly-java-jdk11-7.3.9-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: f61ba3c3ad174234990002fbec0dac71b3e16df31c14fb741d965e460c31cacc
eap7-wildfly-java-jdk8-7.3.9-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: 37a248ef7a869f6c50057e5830be83d06adbbffe6b7143c94dc5b1d534be0c7a
eap7-wildfly-javadocs-7.3.9-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: ffea623308cf835e9e4f7a3b88fff21d59e25caf109e9f05e20b4f9ff78f580a
eap7-wildfly-modules-7.3.9-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: 128d13a92feef24d826a85971e2949d81db7079af48b42b96c9e1256625c8a33
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 016ba783ea5faf7b745f0c9e0ae81a3dc232fd9f3b75bd1e74f93c04c846ab77

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.