Red Hat Product Errata RHSA-2021:3656 - Security Advisory
Issued:
2021-09-23
Updated:
2021-09-23

RHSA-2021:3656 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform 7.4.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.0 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.1 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)
  • undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
  • undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)
  • wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)
  • netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)
  • netty: Request smuggling via content-length header (CVE-2021-21409)
  • jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
  • apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)
  • wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)
  • wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, ensure all previously released errata relevant to your system have been applied.

For details about how to apply this update, see:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64

Fixes

  • BZ - 1937364 - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation
  • BZ - 1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates
  • BZ - 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header
  • BZ - 1948001 - CVE-2021-3536 wildfly: XSS via admin console when creating roles in domain mode
  • BZ - 1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
  • BZ - 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
  • BZ - 1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS
  • BZ - 1976052 - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression
  • BZ - 1981407 - CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer
  • BZ - 1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
  • JBEAP-18401 - Tracker bug for the EAP 7.4.1 release for RHEL-7
  • JBEAP-21231 - (7.4.x) Upgrade jgroups-kubernetes to 1.0.16.Final
  • JBEAP-21257 - (7.4.z) Upgrade Infinispan from 11.0.9.Final to 11.0.11.Final
  • JBEAP-21258 - (7.4.z) ISPN-12807 - Simple cache does not update eviction statistics
  • JBEAP-21261 - (7.4.z) Upgrade to wildfly-http-client to 1.1.7.Final
  • JBEAP-21263 - [GSS](7.4.z) Upgrade yasson from 1.0.5 to 1.0.9
  • JBEAP-21270 - [GSS] (7.4.z) Upgrade undertow from 2.2.5.Final to 2.2.8.SP1
  • JBEAP-21276 - [GSS](7.4.z) Non Transactional Cache needs to be invalidated after commit on JPQL update/delete operation
  • JBEAP-21277 - [GSS](7.4.z) Upgrade Hibernate ORM from 5.3.20.Final-redhat-00001 to 5.3.20.SP1-redhat-00001
  • JBEAP-21281 - (7.4.z) Upgrade xalan from 2.7.1.redhat-12 to 2.7.1.redhat-13
  • JBEAP-21300 - (7.4.x) Upgrade velocity from 2.2.0.redhat-00001 to 2.3.0.redhat-00001
  • JBEAP-21309 - (7.4.z) Upgrade artemis-wildfly-integration from 1.0.2 to 1.0.4
  • JBEAP-21313 - [GSS](7.4.z) Upgrade Ironjacamar from 1.4.27.Final to 1.4.33.Final
  • JBEAP-21472 - (7.4.z) Upgrade Elytron from 1.15.3.Final-redhat-00001 to 1.15.5.Final-redhat-00001
  • JBEAP-21569 - [GSS](7.4.z) Upgrade HAL from 3.3.2.Final-redhat-00001 to 3.3.7.Final-redhat-00001
  • JBEAP-21777 - (7.4.z) Upgrade jberet from 1.3.7.Final-redhat-00001 to 1.3.8.Final-redhat-00001
  • JBEAP-21781 - [GSS](7.4.z) WFCORE-5185 - Update ProviderDefinition to use optimised service loading API
  • JBEAP-21818 - (7.4.z) Upgrade elytron-web from 1.6.2.Final-redhat-00001 to 1.9.1.Final
  • JBEAP-21961 - (7.4.z) Upgrade remoting from 5.0.20.SP1-redhat-00001 to 5.0.23.Final-redhat-00001
  • JBEAP-21978 - (7.4.z) Upgrade WildFly Core from 15.0.2.Final-redhat-00001 to 15.0.3.Final-redhat-00001
  • JBEAP-22009 - [GSS](7.4.z) HAL-1753 - The Locations table is not updated after changing the profile in breadcrumb navigation
  • JBEAP-22084 - [GSS](7.4.z) Upgrade PicketBox from 5.0.3.Final-redhat-00007 to 5.0.3.Final-redhat-00008
  • JBEAP-22088 - (7.4.z) Upgrade wildfly-transaction-client from 1.1.13.Final-redhat-00001 to 1.1.14.Final-redhat-00001
  • JBEAP-22160 - (7.4.z) Upgrade jakarta.el from 3.0.3.redhat-00002 to 3.0.3.redhat-00006
  • JBEAP-22209 - (7.4.z) Upgrade commons-io from 2.5 to 2.10.0
  • JBEAP-22318 - (7.4.z) Upgrade WildFly Core from 15.0.3.Final-redhat-00001 to 15.0.4.Final-redhat-00001
  • JBEAP-22319 - (7.4.z) Upgrade undertow from 2.2.9.Final-redhat-00001 to 2.2.9.SP1-redhat-00001

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap.src.rpm SHA-256: 89b8f29473958768bd9881e6d4b26ca1c44a360f222f521dda424f94a25dcc05
eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el7eap.src.rpm SHA-256: fb03e6127f2973e44f1f684458e0c8bd77a57428e0b151362b9cfd80b88c7d12
eap7-elytron-web-1.9.1-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 0f0eedc27d3f6d809ed7ff276b13cb1b7bb16243d214983b281b61d8f687836d
eap7-hal-console-3.3.7-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: f6978e40fcf5b18d021a743a9f606b0430900d9bee242f8fb95e656819f05312
eap7-hibernate-5.3.21-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 88ca020c8d392e13add4b6839cfa0e02a43b4916bf6bf4f1ddc8068c521458ea
eap7-infinispan-11.0.12-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: be30a6d8f810395745bd3a523a33e94266060ea8f62af5ee6e582902e6794e27
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 0766c5ea52d8a583c0a537832d9aa43eb5ebd0f0170413b09c9ea8357aea8102
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap.src.rpm SHA-256: 6a7b4565a07f98b7a3f5fbcb636b571da5af52d766f76421ec1983edeab20210
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: f32f5b7980f48af2c1bf2a0f3135435eaadbf6299a77585d10ae45b83792346d
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: 80c7fd58ac0aedf11106959a43e361c6a9edf41d4d5219f082280c67ed33c08f
eap7-jboss-server-migration-1.10.0-8.Final_redhat_00009.1.el7eap.src.rpm SHA-256: 5d3de09a36e57b51cc2b24012f19331c81a713134ccfccde62014b6af7a20272
eap7-jgroups-kubernetes-1.0.16-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: c6ae7700cee79f9c47fdf9d7f68b28e103ffa894cb10fa363418faabd27c29a9
eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 8ddaf4f888db966df215f8cb26ee49bd221d79743882ea8cfe2a9df70af9db42
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el7eap.src.rpm SHA-256: f15524a4442da3a31a3aa67cfec651ff895f5d0cc1f95e2526bb3b7890c554ba
eap7-undertow-2.2.9-2.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: 5890cd91096fddee693191e6afe03d31327315d50ad25439efaba7fec7e5c5b7
eap7-velocity-2.3.0-1.redhat_00001.1.el7eap.src.rpm SHA-256: 66af75f19d3ddac9dca9485d7a50b2b13814b1ef9c15bd8faf3208c1dc990442
eap7-wildfly-7.4.1-2.GA_redhat_00003.1.el7eap.src.rpm SHA-256: a066bd61eeff02376ca10c4d37ef82a8f81bdd437df164af6e9b86955caa4736
eap7-wildfly-elytron-1.15.5-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 000b4aab920d4fe0a64cfd75bce269125c4623051501c07ae543afc12e099f4f
eap7-wildfly-http-client-1.1.8-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: e684fe0607f0a894231f9b3ced02ab9503c3a1c93a6cbad062a26e2004f70c01
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 5cb50c11d08db0ff0a86b3d544d0b83e922744d9b766f226a59c13f5513a12bd
eap7-xalan-j2-2.7.1-36.redhat_00013.1.el7eap.src.rpm SHA-256: 56996bc0975554d3e483aed409350a62919a94708a1c09c98d6e48df5a9a3da7
eap7-yasson-1.0.9-1.redhat_00001.1.el7eap.src.rpm SHA-256: 409e0846e17aab44fbfaeb79265e214388ee6c2495196a70ec6a78c55c73424a
x86_64
eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: cba5a695e660cfb2bf03487a6fb611a90312fb50d31882c7a504e57ab44ffc58
eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 6f90f129e08d8baedb7104c1ec480b033d45e4103ae1987e63ee56598e3ba354
eap7-hal-console-3.3.7-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fa93110588f61b66cd6210dedae0487aa709a2e02a987c385cb6ce43d3ef6652
eap7-hibernate-5.3.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 72296ecef1aa4a15af8c8c848479bde09549c359b94c47d46f00d6b2205face3
eap7-hibernate-core-5.3.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 6b8f832ccf3725270d9569e82e3621b13e109628278c1d9c0dc97fe43cac8cae
eap7-hibernate-entitymanager-5.3.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: ac10d7dc5807757c489d962c20fd57b2269441762aca54ca5f1a401783333ab4
eap7-hibernate-envers-5.3.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 13f5a00d8671f3ce07933ce0b28ada4959e1aef6b504e32c36aba94d6240ff20
eap7-hibernate-java8-5.3.21-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fa869009134fd568b56b3b8b05d86662eb9edba1012de0fc107c9bf221c8acdb
eap7-infinispan-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 563ef68933a550cc73a88e1ee3f15571350521952ffb33bf1776a95132459091
eap7-infinispan-cachestore-jdbc-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: ad92cf10545c73821d9885b537e7b00e3d2db67d4d6da11a68839c2d2bbaa061
eap7-infinispan-cachestore-remote-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b15ccd8eb69cb509b42facde612d8e9b1cd6de64e62cdbd70064d045d02fd10a
eap7-infinispan-client-hotrod-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 873f9f26b88603a03f712b5c9c72dbb2e026aad7f55306dd97404b962f98ebb4
eap7-infinispan-commons-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b57a2375cca1db89696b75356270e207d1fd8e1867ad18473e633224a4fa3fa8
eap7-infinispan-component-annotations-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 8aba8a0f1f8c6c3773ba5768d5e462982cdbcda6b9a2b06ce2b0d62f5f2f806e
eap7-infinispan-core-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 317e256d6f3b0ed038075bcddd97aa529a891ec2141559362a35f8468887cf35
eap7-infinispan-hibernate-cache-commons-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: c82095db20572507b96dad89ed58d244277259c6b4ed1f9764d1666bb0b96645
eap7-infinispan-hibernate-cache-spi-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: c4724e3860c914de19cc177a4a49f0b25143f6d3a1cebd4b55dbca91c06041e6
eap7-infinispan-hibernate-cache-v53-11.0.12-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 174d83618078eef10270638d7fea14869523a4ad5c9c3870a4e4fe5d04a9a52b
eap7-ironjacamar-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e6c07b8dedae303fc3c38ce6f8dc9a837ce70118d3177958b82ffa073bfe583a
eap7-ironjacamar-common-api-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5829aee6768bb5aecdd372d9deef29cf466a2da5e2b2a15319211b9da1ea327f
eap7-ironjacamar-common-impl-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 764c2948e88d4d2c1c18ed295507284938910ac51b0d13886128b6d9104da2de
eap7-ironjacamar-common-spi-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: f171406b46cfc50338c4ff71c35046ef93f59364a2490a46734033a5c6f27d1e
eap7-ironjacamar-core-api-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b8284e3ee9d0866b4c2d04024539c3c8a252222b835696b17196cdd96d16211b
eap7-ironjacamar-core-impl-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1783f94962f779e6d3de9b45eb795b09ea4f534ed835d097edb1d1a587c91a63
eap7-ironjacamar-deployers-common-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9ca71cca23d0f38a6820bf0e3c43e7509d93c0edddc0d278b95edfcee9d6006d
eap7-ironjacamar-jdbc-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e8aa1bf3630bfd54a81feeba5adaa4fb2ec625220361730a24e56753600a93c2
eap7-ironjacamar-validator-1.4.35-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 439c9bb4984790b403e9838425f51f0c2e6f5e505d0aafe83dac3b25078db999
eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap.noarch.rpm SHA-256: f621fcbd5f409d88e014e9b0be42ececbfe62a69cca66a5d9e934775f012688f
eap7-jberet-1.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 4f76ea1e808c7d636cd4d3e30ed59c1e5494d37497ead1e62e6c62306558d037
eap7-jberet-core-1.3.9-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b5de01a2a701549c3348b9e1e531596e3b936e4f695b6a52ec03559a05f58b8d
eap7-jboss-remoting-5.0.23-2.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: 3bc55fdd23a77efafff3305560a517f511ae305713d4c582e7cf843282ff8d1c
eap7-jboss-server-migration-1.10.0-8.Final_redhat_00009.1.el7eap.noarch.rpm SHA-256: bbbe91a3e59afb10d51fd07eed13e12d44901114e0ed8976a3ed213dd47f237d
eap7-jboss-server-migration-cli-1.10.0-8.Final_redhat_00009.1.el7eap.noarch.rpm SHA-256: b4b00ee2034a0247011f6ea46012303b5d51e47812b8f2d4503f182bb22665cf
eap7-jboss-server-migration-core-1.10.0-8.Final_redhat_00009.1.el7eap.noarch.rpm SHA-256: eb4257f4267a819d76323601539571447bdd19415f2368f985d9e660bfc53a20
eap7-jgroups-kubernetes-1.0.16-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 536e42aaf79c4e5ed71102a48be8fe785693d51e8f6dff8b71222ebc9d23687a
eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 0459d95ef8f7fce65bc6a59d94ad978f452f3435f74eaa13dbf919005646f0b6
eap7-netty-all-4.1.63-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 78bb64a830d118bd89372788350b67ffaada57d4df6c5251041edf8c64b4015f
eap7-picketbox-5.0.3-9.Final_redhat_00008.1.el7eap.noarch.rpm SHA-256: 4eb2234c28367354dafa0836885a92fe89af7a3c356dfa56350df38a581eb9bc
eap7-picketbox-infinispan-5.0.3-9.Final_redhat_00008.1.el7eap.noarch.rpm SHA-256: c3798ba6e91e1d2906332e1f94e051d60046484023972e1d6cfe99bb76bc3eb5
eap7-undertow-2.2.9-2.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: 0b1ece01346eb4b0ac7940d65e3480acce9498578c53831935dcf1b1b02905e8
eap7-undertow-server-1.9.1-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 54c24fd44b3a1c56dd44ae01b7475c76193be5bf4a60a215b3ea877727166ebf
eap7-velocity-2.3.0-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 117bc40d340541c95db9f48cdc3dd60320573482d1aaf58a7593396384cc4d68
eap7-velocity-engine-core-2.3.0-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: b013e990f4a56ef4c6433a2a915a1d67848b2d85e7791dd2e571781d10a75b55
eap7-wildfly-7.4.1-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 850eee51cf40cfdc6e6bdbd1ede1b815c9b5453e3ce384847913241fd643c05d
eap7-wildfly-elytron-1.15.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 46751defea57bccdd853ff76eeb5a8d5412036f38300aea8161dd4139d078328
eap7-wildfly-elytron-tool-1.15.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5795c7210e101833f7433b9454f04d982253fe56e35802b75c4c381ba63b4011
eap7-wildfly-http-client-common-1.1.8-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 3411e2cc14d4e6e4eea63bbc4c9c914184d0f4044e6a072a3e2376bdcb2b6ff3
eap7-wildfly-http-ejb-client-1.1.8-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b604102e6ea37a359589fd43372b0754c3e2f7740f8ef30a748f92fd7401c82e
eap7-wildfly-http-naming-client-1.1.8-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b425ceee16b79ead400841ac009004378617666aaa550860be4901214d20e00f
eap7-wildfly-http-transaction-client-1.1.8-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 4d50ebe32f0d554cb0b49f284c52fcd80a88722a5ec96d23ea799609ba504511
eap7-wildfly-java-jdk11-7.4.1-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: af4177c9ff1ee20e64e6f45f1f4816e355ca6149c7aaf56f8a9d5ff1dfb4139b
eap7-wildfly-java-jdk8-7.4.1-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: e72a5524d04be004143062e90dd8975e83578bec690068578bf135d8c8ea6ca1
eap7-wildfly-javadocs-7.4.1-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: a9c9667a7903c80cc03bd90b335b5b98dc42fbd4d86bce59e8b40f50412d58ee
eap7-wildfly-modules-7.4.1-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: c80de238e582dec5ff544db000f1218265c0a194bfd20e5d3684fe91513791ad
eap7-wildfly-transaction-client-1.1.14-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 016ba783ea5faf7b745f0c9e0ae81a3dc232fd9f3b75bd1e74f93c04c846ab77
eap7-xalan-j2-2.7.1-36.redhat_00013.1.el7eap.noarch.rpm SHA-256: dcc4908cf06e4c314cf399c615c0c0ad7132c650fd8378e8aece72a5f0cb6c57
eap7-yasson-1.0.9-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 79b5445c581db872c1f61c8b3f2d73b3f31d7cf8b12024320f7b3d9499b464e6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.