Red Hat Product Errata RHSA-2021:5150 - Security Advisory
Issued:
2021-12-15
Updated:
2021-12-15

RHSA-2021:5150 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)
  • wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)
  • wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users (CVE-2021-3717)
  • jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)
  • xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)
  • resteasy: Error message exposes endpoint class information (CVE-2021-20289)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 7 x86_64

Fixes

  • BZ - 1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information
  • BZ - 1977362 - CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
  • BZ - 1981407 - CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer
  • BZ - 1991305 - CVE-2021-3717 wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users
  • BZ - 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
  • BZ - 2011190 - CVE-2021-40690 xml-security: XPath Transform abuse allows for information disclosure
  • JBEAP-22144 - Tracker bug for the EAP 7.3.10 release for RHEL-7
  • JBEAP-22314 - [GSS](7.3.z) Upgrade ironjacamar from 1.4.35.Final-redhat-00001 to 1.5.2.Final-redhat-00001
  • JBEAP-22332 - (7.3.z) Upgrade Elytron from 1.10.13.Final-redhat-00001 to 1.10.15.Final-redhat-00001
  • JBEAP-22343 - [GSS](7.3.z) Upgrade jboss-ejb-client from 4.0.39.SP1-redhat-00001 to 4.0.43.Final-redhat-00001
  • JBEAP-22363 - (7.3.z) Upgrade RESTEasy from 3.11.4.Final-redhat-00001 to 3.11.5.Final-redhat-00001
  • JBEAP-22490 - (7.3.z) Upgrade jakarta.el from 3.0.3.redhat-00006 to 3.0.3.redhat-00007
  • JBEAP-22501 - (7.3.z) Upgrade Apache CXF from 3.3.7 to 3.3.12
  • JBEAP-22523 - (7.3.z) Upgrade wss4j from 2.2.5.redhat-00001 to 2.2.7.redhat-00001
  • JBEAP-22734 - (7.3.z) Upgrade Ironjacamar from 1.5.2.Final-redhat-00001 to 1.5.3.Final-redhat-00001

JBoss Enterprise Application Platform 7.3 for RHEL 7

SRPM
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el7eap.src.rpm SHA-256: d2620f73ce16c1710f354106515d1137ce9b5d0140b2730fdb2327fcb9f0677f
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: deb0512b4328a8eccf810bedb96c3ed37de2080e95a72fc2f15bd6e8576fe7d4
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el7eap.src.rpm SHA-256: b6e4a608c56cf995217376c7254de2d6c2fe73a16079c793cd2d553b73247ac7
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 31c6001f27658b771492c18b6a249d92c34fe484425d1358b2dc0ed95a2b2d7e
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el7eap.src.rpm SHA-256: 0835bb3c48acfd45b481e8333f9c5c05ab89ffed8a7ee77591f5f3572e11486d
eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap.src.rpm SHA-256: 90970976175c3690a080fa28f4d23f64b1913816b88b7d708aedc30a4b70eb0b
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 1fc147fcd99a34eecb3b8d29f0c4452c651d8dd6d3abe9a628a5877ba390882c
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: 4aaebe130f6a7bbed4a65c20fdcc8bdd9ff963bd589f983b0e8b50ad6f81fdb3
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el7eap.src.rpm SHA-256: 6402a4344ec08841383afca3639812feca127ff7c1438b550c82ab716e521a65
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 006e9cb599393b255af597536ed63fd757ae20de649ab53db73de248c9b51b9c
eap7-wss4j-2.2.7-1.redhat_00001.1.el7eap.src.rpm SHA-256: c43cf745da96aea4c05d15c1d7af4540aa3d64a9f589e3e8fdd737d9005b3bc7
eap7-xml-security-2.1.7-1.redhat_00001.1.el7eap.src.rpm SHA-256: e26a0b2613b4823a9b208ec71f107b9f76edaa2f0a6b011a939adad38443190b
x86_64
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: adbbe85a2a1af653f08479042851486dd2bd5cdbdc8edc67b940fd76b2da094d
eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 61fbd695d4d85d9df65f2a48a088bca3815b8ee6d502db9ad5e218ddbd34b9a6
eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: f42a8ff8723eb8fc083da6519ef7af708305abaac2533561063543045126ddd9
eap7-apache-cxf-tools-3.3.12-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: de2ef499d57e901c93410801ae79c0c02f3f310bd60b5259c8449be5529c4b29
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 4fb36385f57bd28a13730611d6a03db2950ef5483b26f8a844031ac6e94fe3ae
eap7-ironjacamar-common-api-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 8f9c6569847158fd300d81de58ad026193ea7b2e55fc7ef56b51c5d7427efb4f
eap7-ironjacamar-common-impl-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: dcd19a8f337d00e4c6937f89f929013416e8a911ee46654321e0b9b2b9ffbf05
eap7-ironjacamar-common-spi-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: eb2b1ce4af6f47f8f96972d60554bd7b99dda1f770e7b9c606af93a3c72a5466
eap7-ironjacamar-core-api-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: a2d72c609b062cd3b3914626209ca01df8e3fa0efe345ffcd5eeef123ef8910c
eap7-ironjacamar-core-impl-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 18e21c5b071f59fabe433d85e1630623eea7877f634814d96f2785bf6ba92862
eap7-ironjacamar-deployers-common-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9bd08e447c35499120269be42f2ef7365436e12a2205d38d8f359b867eced9ae
eap7-ironjacamar-jdbc-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5fb6b02f81d76007076e6d4a114794e3f128f038977881a7b9bc9ed8a3ead37a
eap7-ironjacamar-validator-1.5.3-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5c111452c481aa3cd8eaea9e92d44577c6a7529b56f67f560e4fe72d2a479aab
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el7eap.noarch.rpm SHA-256: 4c4d5b0448d5fd83568ebcff9d25385f44313552d21bae3606404083abf5745e
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 60dbf2f8a57d3ace7365a600fd895bd42fd2c0a1ae45d08e751dc0a7389640c7
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 58ef415ac0da9cc7b2ea052436f4f04f3b798bdea58d34f7757aebec196692cc
eap7-jboss-server-migration-cli-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 6e6c29776bb6655d9abc38e9d3478b38be26da201525495188dbd8c8a628be8c
eap7-jboss-server-migration-core-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: e8de2527a4e02a86162d392bcafebb7b532b73fa825bfb765134a4ff9d4b890b
eap7-jboss-server-migration-eap6.4-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: a8286bca810827ca2493f334d3754e1a8a86310452e7e5b19ee9954fc5892f0c
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 9d2e36817b5bb3afdae7f69726b94cfece68c6c63093e7e2f0411aebf97d8b10
eap7-jboss-server-migration-eap7.0-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: aa8fc212e15baf2622edaa343b3ceb49eefff78607b37513a2999ac6308b1a85
eap7-jboss-server-migration-eap7.1-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 6957e0ce830eca24507f143c088bb10e368fcdebe1d185dc59830938973301ee
eap7-jboss-server-migration-eap7.2-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: d028f114cf71e34775534495e4a005ce24a794d13245b0bc22f4cfb8963971a3
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 219ec1a09e873d951a7afd434f294c24938823667b1dfd6238540e1c85801045
eap7-jboss-server-migration-eap7.3-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: cc90e3fe9be8a204463655f9491d9c2838f4167afdc8dd081fc0d60788583afd
eap7-jboss-server-migration-wildfly10.0-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: fcc2d454776537cf299f2cfe5056997623c0aac081b5c76c881f49ad6597970b
eap7-jboss-server-migration-wildfly10.1-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 18324bf643148ad98d7b333e8656b55d4445b188246c11a769e46045b8ec1ad3
eap7-jboss-server-migration-wildfly11.0-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: f8ab8ea566b85f9de6a26761c8e95951d31d2957a40b820c49077ebea76f1b15
eap7-jboss-server-migration-wildfly12.0-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 8990024e04cb3089721c584eba421cf8f004b19d5155d76f295303faf2e25624
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 34979f1e37de4dd05e7b161f48b94e311ab56e64135aeffadad5c4bf52805972
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 7b8a0f563264a0d8282687801dbf8a8c1d094e84873149c69a1c730d3f5f1041
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 6a7ef1ef98a1e05a788072d56d0498b20f541eef020410e188a09d1d3e146e8b
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 657af2da4aefef7bb8a77f17cc0163b5c00d920f4d426dfd87446c208fdabe52
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: d3458dd28c6aac3c635cf85844d68f1da5325bd745084b3504ed8c26a0feac81
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 6422ab2bfb10fab65d0deafb53823f18cdb6882707356674e345a4011ac1a3e9
eap7-jboss-server-migration-wildfly8.2-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 0f9d75b75f0e51c0cee7e8c78f6540cdce7c601459e5e2c8136968ce90d979cc
eap7-jboss-server-migration-wildfly9.0-1.7.2-10.Final_redhat_00011.1.el7eap.noarch.rpm SHA-256: 1a137fa3c3ad8db4d91326c695e58e582348874d7a74b1f872f3f686424b7591
eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: 73df5d89f52aee95b8c1366f7560e11dc765669083e2a0c7af37c1747556bdd6
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9e106ce0c5a02132e61118151eae21c0e245f07b67f2610f7198fcfea8448f56
eap7-resteasy-atom-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: ec16c7d86bd45a2a3d5512853a12ea0f34f577f09825bf102f7826843441b52a
eap7-resteasy-cdi-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: f2b1e730da17dcb3b299d58a07c849c2001f5d7e86a355b729d709a54cc979b1
eap7-resteasy-client-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: f6e02acf0a99760bb6a3c014360131e44ffbf376ccf41fafc13b9e277ef3c9a7
eap7-resteasy-client-microprofile-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 99a28fe6d87864c77d0150a07da05ac97e13e093f36357917be5c51cdd1b46c5
eap7-resteasy-crypto-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: ec1ef82df3c9156cd835f349d2dc8c979c53bd1ebd4e990333c543720ae05b16
eap7-resteasy-jackson-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 7ceda79f934a3ab871acd07bf8a55bee94d1916fd5bd376637848ddd39bd68dd
eap7-resteasy-jackson2-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 362f0484812441117a93eee96858f9afc27dc18d35d778f99e17bceecf293ad1
eap7-resteasy-jaxb-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fb2557b898b5af5b63ff6eac029fd8414208189f757503db56bf3e5e7ce98beb
eap7-resteasy-jaxrs-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 71ce606f3b62c125757ec215987ead9aaf4c6afeadc5091c8fa41c41c6cc386a
eap7-resteasy-jettison-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 031d80078747f126f1c532b25bbc8cba59ceb72869881c7e19d5ef9a2f091993
eap7-resteasy-jose-jwt-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: d7197d4f1259a6252cae7812af571335004bd55ce68cd2feb14f5ddcb74188e4
eap7-resteasy-jsapi-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e0717283ce3d7e739f5c14b813850951787aea9ac90af54ca262c3eb5ef9998e
eap7-resteasy-json-binding-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 66a5001f500ce68f828b54767f14db2cb6c08e8b2bdaacb0a195e72f7f2cdd17
eap7-resteasy-json-p-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 2f4311d0f7a251882bb8fde59da8f5fb0a7c4572fc339547739b47167c9717cd
eap7-resteasy-multipart-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 895902c77bdc42f5b84f953770b97192581f075411b1b944e675a6dd786f2840
eap7-resteasy-rxjava2-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: fab65fad8beb3d03da92505827b4d38b51a1740a94b8c732387ce450d4c9d181
eap7-resteasy-spring-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b9f22591b4893a24c07aab79541c1bb1e0f00f8ca9381c03f5700826efcd3f35
eap7-resteasy-validator-provider-11-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 38bec6b949831958d767cab028a817ab7293eaa4e47d63160c6c96331c219c77
eap7-resteasy-yaml-provider-3.11.5-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: c5e79e1ac645b9297db1c667d58d491a58590e6278b61357b9f2bd72443a05ef
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9ba8cb99114564f91c4c3953e76ae0370b27e74ed47512d8343dc73d4dcbbd4b
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 2e6557a2aad2c4034fb4764f872a97bf658ce9f024f65a17cee092be5b7ee798
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 53dece6eae0af1fa9867b64874cb17c327d7f5a59c57cf067db214c66a205a22
eap7-wildfly-elytron-tool-1.10.15-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 3c37c5a8effae7a3a8e8547ac69defc5a01f5dbb9f96071a68f7a7a772b20df3
eap7-wildfly-java-jdk11-7.3.10-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 603e0cc838f692dd9fa2cef1d58ddb86ab2fedd8cfcdb083c2c028f29f898b45
eap7-wildfly-java-jdk8-7.3.10-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 714e2b1b1ae8b6693b0150b12ede4d72109570435c7b595ab47dabecc06f6ed3
eap7-wildfly-javadocs-7.3.10-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 4b32ddf8d627eead43ba3a5c7a915d7fc5cd5e843c038395ba670455df06e445
eap7-wildfly-modules-7.3.10-2.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 4d318743f70115d797f66d5857677b9c75d3ccfe9a805fd8d2a1aad30714099a
eap7-wss4j-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 90620e12126f632d7e3c8b7e21694170c710b118500ced7e409d5d94462d32a3
eap7-wss4j-bindings-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 8368cd44b6073781f13d7ca02456a6a7459832d8ac6e69e86f5116f88555edb4
eap7-wss4j-policy-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 18b6f8f5275f707128469aa3a78faf9d7ca6848f6eeb58820f1dfb77c5b04375
eap7-wss4j-ws-security-common-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: dc1bcc6e8ca75747b6aaa3efdce0a025636127668c6378e98f2b0e2f82c0a822
eap7-wss4j-ws-security-dom-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: cf3b03600bc3b49145d576096512a03261e068766392875a8697e9bdd706bce7
eap7-wss4j-ws-security-policy-stax-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 481d203d5ec10456ab08c807f1796dba80f05a01857a3652de8012e5140674bf
eap7-wss4j-ws-security-stax-2.2.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 0728d5a9c1a805d4f88ce1521da85debd867569893088fa1eea5fd6446a8df10
eap7-xml-security-2.1.7-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: c2c9b38e8383a2f3bbd9b6075637d78ccb0372733b0167d1b17b1d0f209bd808

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.