Red Hat Product Errata RHSA-2021:5149 - Security Advisory
Issued:
2021-12-15
Updated:
2021-12-15

RHSA-2021:5149 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)
  • wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)
  • wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users (CVE-2021-3717)
  • jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)
  • xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)
  • resteasy: Error message exposes endpoint class information (CVE-2021-20289)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 6 x86_64

Fixes

  • BZ - 1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information
  • BZ - 1977362 - CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
  • BZ - 1981407 - CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer
  • BZ - 1991305 - CVE-2021-3717 wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users
  • BZ - 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
  • BZ - 2011190 - CVE-2021-40690 xml-security: XPath Transform abuse allows for information disclosure
  • JBEAP-22143 - Tracker bug for the EAP 7.3.10 release for RHEL-6
  • JBEAP-22314 - [GSS](7.3.z) Upgrade ironjacamar from 1.4.35.Final-redhat-00001 to 1.5.2.Final-redhat-00001
  • JBEAP-22332 - (7.3.z) Upgrade Elytron from 1.10.13.Final-redhat-00001 to 1.10.15.Final-redhat-00001
  • JBEAP-22343 - [GSS](7.3.z) Upgrade jboss-ejb-client from 4.0.39.SP1-redhat-00001 to 4.0.43.Final-redhat-00001
  • JBEAP-22363 - (7.3.z) Upgrade RESTEasy from 3.11.4.Final-redhat-00001 to 3.11.5.Final-redhat-00001
  • JBEAP-22490 - (7.3.z) Upgrade jakarta.el from 3.0.3.redhat-00006 to 3.0.3.redhat-00007
  • JBEAP-22501 - (7.3.z) Upgrade Apache CXF from 3.3.7 to 3.3.12
  • JBEAP-22523 - (7.3.z) Upgrade wss4j from 2.2.5.redhat-00001 to 2.2.7.redhat-00001
  • JBEAP-22734 - (7.3.z) Upgrade Ironjacamar from 1.5.2.Final-redhat-00001 to 1.5.3.Final-redhat-00001

JBoss Enterprise Application Platform 7.3 for RHEL 6

SRPM
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el6eap.src.rpm SHA-256: 8dc2468662ce5be9b85bfd0a7c9a6c0c5b23d8be96ac7643edecd8aab5d0362b
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 4593c2313ed159c42e211bd82e65c0dfc46a0e6de3868bfc46e427f5f0516d81
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el6eap.src.rpm SHA-256: 35cfe3a5e91a0b1fbde7ad3cc9607d1c84572193bb1a5030e568c30e9b718e8a
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 687faf9056884ef68d79d714391a4d681581ee0bc2f5bf0145c3426b4d62f236
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el6eap.src.rpm SHA-256: 9d545fb2360d4bb5a0a6dacfb148443a4b02f2ebf7ee4bc6f278a1bed54dc6c0
eap7-jsoup-1.14.2-1.redhat_00002.1.el6eap.src.rpm SHA-256: 21de5d18baf7880494308716e41b6d0b515697f8a7d81b767a3583012cd1b79d
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 53052cb64ed4e042674e7e9fc73b706cf374955975815260add46f88b01467e2
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el6eap.src.rpm SHA-256: 9882b38932502d05d800fcf60df4145dc5b3f37bbe6719fb8e845e02277c6663
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el6eap.src.rpm SHA-256: ac0b785c6b009070e2a5b978e4bb508fc16575eeae58e16cdfdf57e1b36b1c7c
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: fd73c702d278851cb6175b345c83af1785908ec273fcf6e4ea06b3da03acf232
eap7-wss4j-2.2.7-1.redhat_00001.1.el6eap.src.rpm SHA-256: 1beeb14780fcc7214e7bd893a1ca97b0ed2f4545a821bc20fc43f5b0e94c9d2a
eap7-xml-security-2.1.7-1.redhat_00001.1.el6eap.src.rpm SHA-256: 901b771a317302ade5a7647567c310e1c052621e8810b1d5882947e96f3c097b
x86_64
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: b0b893ec7b4d88f9b62ba517e96baa4aa3599d8f64666548a48b70963bd38cda
eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: e96ad74a001e8b6ac5366a6049cb0782fa5da4813372d2f5331bdc3db9b93af2
eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: fc3da7d9458811eabb936f4e70550b12b814e509f6e676a1058f8a7c31c1665e
eap7-apache-cxf-tools-3.3.12-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: d21bdca7990739f5c2255b545d6d1134f041c4aedefa56dd5392033cbd1daa04
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: dceae28b21e46aa7ad5fbf8e9f268b63c629a3afd7a7c03b50780aebb6906f73
eap7-ironjacamar-common-api-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: dc05476b945c2bbc0d121e9e14557fb1a44340522a60492bba61e40685a92101
eap7-ironjacamar-common-impl-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: fb86e7abb5dea7ee3baa18c1935a2d19f90dc03a599c683f45aa741e8171158f
eap7-ironjacamar-common-spi-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 126e2237230511c01a94f2ab64567b5726c0f8d8267658acd0db3c14599f4fa4
eap7-ironjacamar-core-api-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 089a67b5f5f3dcfde7733d303c9bd33fc745b3f5db0c35657d0a4352b7b8bb16
eap7-ironjacamar-core-impl-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: df159ca91eb11061644eecbf571673de0cff486f2b6ba6dfedcd990da07d4f9a
eap7-ironjacamar-deployers-common-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4bf37f3d041d51a2d62c4876f9d98b6b007991d2a43bbf851c3e40f699b0708f
eap7-ironjacamar-jdbc-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: baa1e1c93b1166a5672371952fd273ceb838dd992e20159de71803e388f23226
eap7-ironjacamar-validator-1.5.3-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 75ebd7ed066274d049033d5964860e4ce322156fd0a96a6ef7781b16ae7511f3
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el6eap.noarch.rpm SHA-256: be5c9ecd154ee9dd781de68bb04b59e81f4fc09d2e003bb1f930c9261fd0be63
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: a6ceddec676c12408b2348d1d46e9b86e7c8f76516ff1baace99f8f3732708a0
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 72a9f3af1fb5786c172344595438c07830612284a078f26a15a9db4facd7b8b6
eap7-jboss-server-migration-cli-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: a109ad4ddadfbc75f66c579919964f9ed9f503c161e9353a5f6d0d0ccc64a003
eap7-jboss-server-migration-core-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 729678f7ca5e92a2c88da12513ff28cb91d2b62fb3c1f1c9c5171c1dd5527960
eap7-jboss-server-migration-eap6.4-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: b19684b5fefff94331c319fba7ed9f9dc3f73b5d3d16e826475e01569eb00fbf
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 2e6d333a8c8213e7e397245483f51e21b0bf89ff25f2da428b5e40c143651c2f
eap7-jboss-server-migration-eap7.0-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 8e39c7494ec2298f82b278b5044d4016228483a3d51954bfef8994a30e28a780
eap7-jboss-server-migration-eap7.1-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 55d4f3247fb6fe241860916a5e63843ffb14af597a7b2d6064fcfd73206b94be
eap7-jboss-server-migration-eap7.2-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 2d113c27ad10eb1bf7856128290b29bbed11a0c0035a34e11be86d3d468ed8c5
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 7b5f56d63ada3fe093e21b381a06fc584d904c063049435de71ae3ac0e12bf01
eap7-jboss-server-migration-eap7.3-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 662d925efaba4bdd69ae1d5b51fc0de7001abea073c00b4d4fc221de14e564ea
eap7-jboss-server-migration-wildfly10.0-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 69015f6cfc4baf396585cb32c45e3ff04c6b64690bf683f7fdb202e86a73b692
eap7-jboss-server-migration-wildfly10.1-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 6dc1cb5201d50090d3a4cc7ecdb39b814be4a9cf6ff39ba34da04a5ff3f7eff3
eap7-jboss-server-migration-wildfly11.0-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: b049b86bc8013f419b1d5af5078f14d95b4026f7ae53e17a0b0d9e343ba5d3f4
eap7-jboss-server-migration-wildfly12.0-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 5890c1f595abde559892756571cd9b412a2936d3df37ce019784119816afae88
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 260e960cccfe97e46e6ff48bde17d1214cea207d9d899974ece4329964ecf94a
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: a8da271b14891c6e3f2a66d7e6092d00bec007414cc4f5791abbfdf067a84cee
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 5346f74e1911620751d263d3e3737e870753c914b006f1acf5a63e905ffb3816
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 49cea1ab240c174487bca1858178e4035854ab83dd616316b5593c08fd60adf0
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 5ad70b5a0190c6256420c592727c4b00b28b71d16ef0b6978867503bd62af351
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 005c451dee7354598520d734592e3784adb59a0713af866fabdd1c348f2e5bf2
eap7-jboss-server-migration-wildfly8.2-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 2945d5be34c4bb6a6a9019c53f16ea1efd1df97cf0c2527a26f5c05c95c1c3a3
eap7-jboss-server-migration-wildfly9.0-1.7.2-10.Final_redhat_00011.1.el6eap.noarch.rpm SHA-256: 50cbb184a8edf400f9994f1df95025ab9ade8b325669f0a9b3d88e2befc91fb4
eap7-jsoup-1.14.2-1.redhat_00002.1.el6eap.noarch.rpm SHA-256: 3bcbaeb19ac052347eef3c26d9a8bd35ccf6903698c4e11fbe54ee5e63baed97
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 60381af12d8a0e0a92df8eaf4ac3a8b4d4e4f1cbd31da18972bb2dcc1fcec77f
eap7-resteasy-atom-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 904af9dc601e95c5d9c4aa60e39b16a97772afcf0fb476c37ad4a632192610c6
eap7-resteasy-cdi-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: bf6fffc07f7439fcbedf7ec9b265fd6ecf9cb8e6c6824da97541211cf2799e65
eap7-resteasy-client-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 0233a3cadfe009befc42bb730c6e43b22dea6677d50069f0143f86d40c8143cf
eap7-resteasy-client-microprofile-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 3c2ea88c7713cd77fc59388c01c722aa482f8f639a8d881f062c4f8cce82ff19
eap7-resteasy-crypto-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: d766b1d827e2cda7bd2e5b3df3938d6dd077d04bf0fddb9ef6e47f82a5d9e4b5
eap7-resteasy-jackson-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: c1568eb69d8dfd2f651d7665d54e843ba189113a7384c786c79eaa83152a8aa8
eap7-resteasy-jackson2-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 59996a18b8fe1f680bd1e09cb94a6ec44c8dcbe0fedd6a13ac9941d5174330a9
eap7-resteasy-jaxb-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: c6c08e1c79e0f25a02cdf9121c2bf6d4288ae0d135a78a0b6ed7434da6e4da2b
eap7-resteasy-jaxrs-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: c5dd62fad1d2697800e8e336d977bbb6b65efada01a65e63b90769b533a54e50
eap7-resteasy-jettison-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: fc0eeadf2e4fe9bd91cca161e323cd640eae1a8fa9e172b6406e6697b7f10c9f
eap7-resteasy-jose-jwt-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 37e52399876a2dd340013f203667a80fe9a21eedfde1ee733e3035c18b777e14
eap7-resteasy-jsapi-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 040a98cba5a00e9be3ebacf8c1e24881c95a2b0df30f4d0a31e7164be3dbb2da
eap7-resteasy-json-binding-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 3a14f2a9ce9c5145ce45c08b10638c66dec228d371851fbe6b095a8329c84f09
eap7-resteasy-json-p-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: ce884de9d23233034ac0eed46ad6194887df486eef04d77bae6d3a7becc26c9d
eap7-resteasy-multipart-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 7566c7eb8cc8bdd5763d4edb45e6754e4233b243e0e8d18d242c27c68ac01413
eap7-resteasy-rxjava2-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: a9b1787c7d0e2d9f6ca6bfa52c986c477ee2f6d69ba7ff7a2f0018599e9baf24
eap7-resteasy-spring-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: ad863ed834c15bcad0b8b954352258994c62d765ea49efc1d5cd729d6a5fbe58
eap7-resteasy-validator-provider-11-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: de7410d992c435d0bc25367db36184d630d7cb95f52c9f7a6f87e3a6558f190f
eap7-resteasy-yaml-provider-3.11.5-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 4cd4e2fb305125a5ba4e81fe68ff7de1c79dcdf30a2ac1897ca6cad8b098a623
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el6eap.noarch.rpm SHA-256: ebc8797a3ec76c106c9856933881ab80d6faca500fe4e7092ff5e31ea13b3cff
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: 0ab2ab977fc7143520b1ab8379710fdd854c2fc55e92ba0544ab158b20851e07
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: bb22c5173acafe3d8bc236c8e5f15012a555e7da3955ff848e7edefaa82635ef
eap7-wildfly-elytron-tool-1.10.15-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 34423b0b5084fc030991b3278670b231ec2f85291a70a727969c4bc8f7d0d180
eap7-wildfly-javadocs-7.3.10-2.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: f7b1af3d72ade8a1827abb3d573b68b3b4afae424aeac157e5b8dc489fbd30d6
eap7-wildfly-modules-7.3.10-2.GA_redhat_00003.1.el6eap.noarch.rpm SHA-256: eb2809778cbed9ac7805caa7937571a37aa060ad9955a0494a2cf33f2e239808
eap7-wss4j-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 378e6ce0d1d3df838fff8d11e27ac4b003f7ff4462de64b848aea3efb40a809c
eap7-wss4j-bindings-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 1fbc1a7368490595f809d9cbabb6d267f66d1afdb7d1f05ba71767b86bb11f86
eap7-wss4j-policy-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: bd4f739fa0e8b2971cdc085b870b0c913acca15c639d1726d22ac3b5d73023ee
eap7-wss4j-ws-security-common-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: d1e4754ffc4787c057c72d16f3e6d2d675aca9aeec70e305f78adcae4c613846
eap7-wss4j-ws-security-dom-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 19ec088b19c6888a1d099820c0443a48aecfc5613b55f16b71d9ce8241edeecc
eap7-wss4j-ws-security-policy-stax-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 3cd1373486948fdc946b047cda421e54a2971652cf39f28ac266b6b25532aa08
eap7-wss4j-ws-security-stax-2.2.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: 48a92b1eb37886966c54e1fc23b77a6c4c7a1e84c6f95ec032f514d104fa7b5a
eap7-xml-security-2.1.7-1.redhat_00001.1.el6eap.noarch.rpm SHA-256: f51a2d81585a3d5d492fcdeb67104e8962e1cc4b0409faa0d0c26371b949f5ca

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.