Red Hat Product Errata RHSA-2021:5151 - Security Advisory
Issued:
2021-12-15
Updated:
2021-12-15

RHSA-2021:5151 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)
  • wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)
  • wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users (CVE-2021-3717)
  • jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)
  • xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)
  • resteasy: Error message exposes endpoint class information (CVE-2021-20289)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.3 for RHEL 8 x86_64

Fixes

  • BZ - 1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information
  • BZ - 1977362 - CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
  • BZ - 1981407 - CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer
  • BZ - 1991305 - CVE-2021-3717 wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users
  • BZ - 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
  • BZ - 2011190 - CVE-2021-40690 xml-security: XPath Transform abuse allows for information disclosure
  • JBEAP-22145 - Tracker bug for the EAP 7.3.10 release for RHEL-8
  • JBEAP-22314 - [GSS](7.3.z) Upgrade ironjacamar from 1.4.35.Final-redhat-00001 to 1.5.2.Final-redhat-00001
  • JBEAP-22332 - (7.3.z) Upgrade Elytron from 1.10.13.Final-redhat-00001 to 1.10.15.Final-redhat-00001
  • JBEAP-22343 - [GSS](7.3.z) Upgrade jboss-ejb-client from 4.0.39.SP1-redhat-00001 to 4.0.43.Final-redhat-00001
  • JBEAP-22363 - (7.3.z) Upgrade RESTEasy from 3.11.4.Final-redhat-00001 to 3.11.5.Final-redhat-00001
  • JBEAP-22490 - (7.3.z) Upgrade jakarta.el from 3.0.3.redhat-00006 to 3.0.3.redhat-00007
  • JBEAP-22501 - (7.3.z) Upgrade Apache CXF from 3.3.7 to 3.3.12
  • JBEAP-22523 - (7.3.z) Upgrade wss4j from 2.2.5.redhat-00001 to 2.2.7.redhat-00001
  • JBEAP-22734 - (7.3.z) Upgrade Ironjacamar from 1.5.2.Final-redhat-00001 to 1.5.3.Final-redhat-00001

JBoss Enterprise Application Platform 7.3 for RHEL 8

SRPM
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el8eap.src.rpm SHA-256: 273d7c4a55ceb84088beb5daeb67750037f8f3e4c30fa1e80af7b5999eadf77c
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: a6177ab83d621f46d1857a5f096a0c2e24c3a5ae4398d2a46a9d44f3009385dd
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el8eap.src.rpm SHA-256: 705eb7b4111b73133a0d7b5e305b7ac5fdf0a1d3284ab24752eb1996727ecb5b
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: a09dc3cda24f32aa6d76b844b8833243f5a974caa6ab6da8213e59b806d42dd4
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el8eap.src.rpm SHA-256: ceb04af86ebd343d119e08e97f004ede15a2de9a5432ba3e59261c7c79786e08
eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap.src.rpm SHA-256: 03ab71df62e5349fdf25ff58427245212ddff4bc782d54b5e5e4189a02ba446d
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 5bd43f16db1f699a476b72e41b45ea0e44f281129f013efb2b43850f1578d567
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: 5e66ac7862623242d3ed2fbed4a26a108e0da51951290b41de37792696d16c6c
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el8eap.src.rpm SHA-256: 730cc9ce2175bb52d6be35f3efedb9d7806a6c62b178a7101be1f15425076675
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: defaf72d82b2b4cf026fc2bdcee89ee2d682b19a5799b88a61c57965fc50631b
eap7-wss4j-2.2.7-1.redhat_00001.1.el8eap.src.rpm SHA-256: d40a633eeda45dbdcfe8528b9594afeb86bc42ac08c7e6c8b6d235e11898224b
eap7-xml-security-2.1.7-1.redhat_00001.1.el8eap.src.rpm SHA-256: 7c614ebbccd958b4d0892c6570438e8384b4d6b870a8ac6f5971c97a3b677612
x86_64
eap7-apache-cxf-3.3.12-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: e57a6b38a49875e80b365b5891c4cdde99e62f778e9f17cb4ba6117b6e55cefc
eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 5dd0e36ad7fb3ff9af353290b69de097d5dad9326eca781245ce3a523a6dda71
eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 86b35489e395d5cd727863b29c0b48955b00371910e9f74b7eeecc15f8207297
eap7-apache-cxf-tools-3.3.12-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: b53286e9cbf7686ec6a0313a72c087fa886f425242d9ca71bd24ae64a4092b13
eap7-ironjacamar-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2eae5f22222f40983861c19178071bb0f1479e64e90a8b7462e99dfd9c3bb4e6
eap7-ironjacamar-common-api-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: aace4852e0e4b6c948e1d65c9b6f2875190355a7ae5d1996c91fcf345decb29c
eap7-ironjacamar-common-impl-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d00f7dcc587fd19acf435e28e08586cb9ac79531c1a2823a7e303361f5f20e5d
eap7-ironjacamar-common-spi-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 34cf42d08a56fdf31e727f1a54690903a5aaf8e32f2498206c89a4eadbc2d110
eap7-ironjacamar-core-api-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 5de488b894e737c014d05b89538e6557085c4602a64b8b71a5ac62b1e004fe11
eap7-ironjacamar-core-impl-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 48c2583c7b4089f98631c8dfac4176c6f04f594912f58dbb0ae8aa8904eccb41
eap7-ironjacamar-deployers-common-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: fc82d0aa593c2919593d77d7f60382890a23480dc033b476cfbfa7ecb1fd514d
eap7-ironjacamar-jdbc-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1eab8d841e2abf980a4208af192695c74fea1384e2bad6bd08287c9609341cbe
eap7-ironjacamar-validator-1.5.3-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 9949fbaa05097616d60a80bfbba240e6024f048478f396fab5cf37fd5b189e2c
eap7-jakarta-el-3.0.3-3.redhat_00007.1.el8eap.noarch.rpm SHA-256: c44e90ca76684706a7c0c7e9091c6b088735b92859954855129502688c21b40b
eap7-jboss-ejb-client-4.0.43-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 90b020705c36d5e9d19cbad529f12afbf5b4951e526b33f7b1d6f1f56caa6232
eap7-jboss-server-migration-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 6332fcb288aad9ef6fa1b993ce3db316e4a581cbd1ab2ff9ee3c5da4664d5d9e
eap7-jboss-server-migration-cli-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 8d5d4c7875dd381860bfdb1280cbac19b69781cfc4ee5890cb1a1dfcf4438a7e
eap7-jboss-server-migration-core-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 25e7845fe87ca6094e304858cb7e06980e639929d5895223cae0ee32402be0fe
eap7-jboss-server-migration-eap6.4-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: b989200bea6dff785f0532cee2340ee3ba04516c6f45861f6100aa208eaa8dd1
eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 7e97049c0dedc8d2ad471bf8f99d0d2510dcd0a97551d668dd8b9920d6300c85
eap7-jboss-server-migration-eap7.0-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 26e08d121168cbc947fd27dd11c1fec916f5927002efcaee554b353372fc606a
eap7-jboss-server-migration-eap7.1-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: b341748fbcc383b6c9a06fabaa1ad6efaf43f4caeb92dc5b1d1e663bbd9940b4
eap7-jboss-server-migration-eap7.2-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: dc2d721f5b523d2859d5ea1493115bcd811f70cc840fa852f573138bb08cb548
eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 66f9163bb3030fcd4532cdbb37a997ff3ce25618f01c0f9ed702739f3b206c96
eap7-jboss-server-migration-eap7.3-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 9c85eb17439238f0b919f7425c1d96bd8fb112dbd387d119e7a96772762759c6
eap7-jboss-server-migration-wildfly10.0-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 08a9c5aba05c44c923556900de3cdc74722c71a00adaf6eec8395f9242ef48e9
eap7-jboss-server-migration-wildfly10.1-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: e544d141c39713bf5f747071c79b0d15f2e643c3771a9e445c0105200b653d8c
eap7-jboss-server-migration-wildfly11.0-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 41c02e8a131f5ca60e5fdb8d0369b15d368da338f4adca8175f685abfc9db989
eap7-jboss-server-migration-wildfly12.0-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 16d5b48d5d6ef5daf233ab7a5a6cd96e78ccb8234460a09e2574accf5ba4fa51
eap7-jboss-server-migration-wildfly13.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 3887cae4f6e773520fd4901cb694fc4f90724c75893592af384370db0f6963ff
eap7-jboss-server-migration-wildfly14.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 81498a7cc46435779c6decdef8fb9a1727cb11f692a1a1065ae1ff1ed7b16507
eap7-jboss-server-migration-wildfly15.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 5e48d4d9049da9fb48a046ab4eb7a364239b05891d846ac710a08b0ea25b96d1
eap7-jboss-server-migration-wildfly16.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: cd6fdc8e26334995a34856f25ee2529fe0eb1ad99b0d71e3433c04a3f0128e9a
eap7-jboss-server-migration-wildfly17.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 8ee4f881f66e51a17d6dd6faa6ac9e9145410aa30af67fa35a186354cc781815
eap7-jboss-server-migration-wildfly18.0-server-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: 60d653e45e4a44b9164027e667c0e6c794e8f12fc03ad2dd4984beaa4c2f9b00
eap7-jboss-server-migration-wildfly8.2-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: e2d18ef8e31939af316120d3e7919a20acf6f8a379bda9790e346465a628f22f
eap7-jboss-server-migration-wildfly9.0-1.7.2-10.Final_redhat_00011.1.el8eap.noarch.rpm SHA-256: b0d2b61707d4584bb38181174f6b1f92522e7bd04dceb9e1d11e8fad4f02ac2b
eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 0ba8ab6af2c03db056fc1bb7d0d1ef9ea2a32836ef2ed2312093e965c5c7afa9
eap7-resteasy-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 26ac80496ac40b96980aa899f25aba56a196603b14f3e6f34739c6a8ffbf8a38
eap7-resteasy-atom-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 925954e9dd0438aec6ea7b9720a064e3dc459a909eeb18652aac21f33b0d6ed8
eap7-resteasy-cdi-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: b070a4c970a7f09c9ec5606e51df3fb69e4f8fe185cca6d6fa4b230512c58c06
eap7-resteasy-client-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 78fb799e12213eabed39aefa904d01a4c3fc697116c7c8c476591e92103a0e2d
eap7-resteasy-client-microprofile-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 57515b37d936f57b99c6c257cd5206ab0b8e6b0af912aa9b7ba84bce9a74511e
eap7-resteasy-crypto-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 9546fb4e8235f40d41444a514baaedc5e9c1189072c67748abfa740ecbbb45d2
eap7-resteasy-jackson-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 8eba464fabe8305926dfaef321fd32300f28979813b76a2530f2cd05d036f49c
eap7-resteasy-jackson2-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2b152db9c3d94ac919cf852a6b875890d4ec2bda844b5f3a58bcaedec8bc54f3
eap7-resteasy-jaxb-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d7e35fd607837ed167e5a686f7f2c9dcd3d665f064d0d72af4b30b042572c2af
eap7-resteasy-jaxrs-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 0beea6a53ab7e9e2aa347bb0670d7d2736f216056e1f3bf83bcd33cf9daec446
eap7-resteasy-jettison-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 5e8a1c1ebca4c0ce7815689f4b529dd5f09a8d40da08d38cfc2e168a06872443
eap7-resteasy-jose-jwt-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: c1d1fafad2f9166ac20874337b11306d2e6e1f3cc491a9e1285d91aa7bfb48af
eap7-resteasy-jsapi-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1cfe7db4284066b0e934272cbc84f9b91f306546b7a73eea6062d523e12ed500
eap7-resteasy-json-binding-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1629378091a533bc24b744c4414546bcdedeea27a0012492b35b724d62722f9e
eap7-resteasy-json-p-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3dfe2ee3cbb47e689f8b078175f5c32a30f6ceb9f62c8ef95a96e1ca08d03634
eap7-resteasy-multipart-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: a7014eaad6ca8175586e1b476805629b2432386523b82a5bbdede659c5484708
eap7-resteasy-rxjava2-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: f6a93372f28b90d82f27119af5e485b874460c3eeff2b2dd299b0f5c17038987
eap7-resteasy-spring-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: f15d4e0ce4a86b24c8a6cc740ba94a8004f429d8b5c5668db6a68f2be0bc078b
eap7-resteasy-validator-provider-11-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 9d4727fe07756c4cbe5bdcc16c6770b8286f0256271ac3639e74fc2c247ff70e
eap7-resteasy-yaml-provider-3.11.5-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: a787427e4355ed3995d8848690f54c10560592769f32d66771ec84b52e6c155e
eap7-undertow-2.0.41-1.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 029fc4cfeb532f8f6358b3a06c8269a17681ca162346898217bbf7cb7c9a4b8a
eap7-wildfly-7.3.10-2.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: f145fcb8fce763d063fc8c227efc07dcf5c608e46b7f542a4969126b86650fbf
eap7-wildfly-elytron-1.10.15-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 815486f6ebd9ac26f0226dd51d65deb5f27fd3bde786001d658141ca6bd3cc20
eap7-wildfly-elytron-tool-1.10.15-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: b0e92fc9567d92484309399b44760fa1227a74a46d33204e8c8c02819b0a8cea
eap7-wildfly-javadocs-7.3.10-2.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 201bd25eb21c0e7af244be1349977c57f8b3c2f18644509691e4be5aad1b2873
eap7-wildfly-modules-7.3.10-2.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: da894bd081a1bd726bd7e9ba4abf89dc26f7b5ed3d74a3ffd5c1d632adf826dd
eap7-wss4j-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 7fb3c37f0ed9d80b9a0deab1412e25ea7ceeb5d57e514a867543ead8793925f7
eap7-wss4j-bindings-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 69d7b2bb722d2f5e4c67420a8686dcbd4c70bb80eb0c53c118f0d9494ce86ac5
eap7-wss4j-policy-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: d7459121c812740f24d19cc090520bed65dc8acce15de8d0b44b9a1e8a7cfe4c
eap7-wss4j-ws-security-common-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: d6a45a08605778f78dc10540eef66369fcf23765b52bfe023bf150d51d4b97de
eap7-wss4j-ws-security-dom-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 7e29e1a558de8d9ab6a61cedf95a1449a83fc44f0e2de79767119f9d0c21eb9a
eap7-wss4j-ws-security-policy-stax-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 23bbd048762f395f595c653ee429b474261993e69bb8d709f199995899c08873
eap7-wss4j-ws-security-stax-2.2.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: d63c6fe8a6563eb435985ce74dee7ef84670627345444e687fef826cb13cf390
eap7-xml-security-2.1.7-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: a9095d77df0c713c3f523c0892abe27cd04df10d1fd80f044dcd09a14a59a84d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.