Red Hat Product Errata RHSA-2023:4506 - Security Advisory
Issued:
2023-08-07
Updated:
2023-08-07

RHSA-2023:4506 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform 7.4.12 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.11 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.12 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)
  • jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)
  • jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64

Fixes

  • BZ - 2182788 - CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray
  • BZ - 2185707 - CVE-2021-46877 jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode
  • BZ - 2209689 - CVE-2023-3223 undertow: OutOfMemoryError due to @MultipartConfig handling
  • JBEAP-24721 - Tracker bug for the EAP 7.4.12 release for RHEL-8
  • JBEAP-24711 - (7.4.z) Upgrade Jettison from 1.5.2.redhat-00002 to 1.5.4.redhat-x
  • JBEAP-24744 - [GSS](7.4.z) Upgrade Undertow from 2.2.24.SP1-redhat-00001 to 2.2.25.SP1
  • JBEAP-24745 - (7.4.z) Upgrade Elytron from 1.15.16.Final-redhat-00001 to 1.15.17.Final-redhat-00001
  • JBEAP-24790 - (7.4.z) Upgrade HAL from 3.3.17.Final-redhat-00001 to 3.3.18.Final-redhat-00001
  • JBEAP-24808 - [GSS](7.4.z) Upgrade WildFly Core from 15.0.26.Final-redhat-00001 to 15.0.27.Final-redhat-00001
  • JBEAP-24819 - [GSS](7.4.z) Upgrade Hibernate ORM from 5.3.29.Final-redhat-00001 to 5.3.30.Final-redhat-00001
  • JBEAP-24820 - [GSS](7.4.z) Upgrade PicketLink from 2.5.5.SP12-redhat-00012 to 2.5.5.SP12-redhat-00013
  • JBEAP-24821 - (7.4.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00014 to 2.5.5.SP12-redhat-00016
  • JBEAP-24822 - (7.4.z) Upgrade PicketLink version in PicketLink bindings.
  • JBEAP-24831 - [GSS](7.4.z) Upgrade xalan from 2.7.1.redhat-13 to 2.7.1.redhat-14
  • JBEAP-24832 - (7.4.z) Upgrade Jakarta Mail from 1.6.7.redhat-00001 to 1.6.7.redhat-00003
  • JBEAP-24835 - (7.4.z) Upgrade Jakarta activation from 1.2.2.redhat-00001 to 1.2.2.redhat-00002
  • JBEAP-24836 - (7.4.z) Upgrade jboss-ejb-client from 4.0.50.SP1-redhat-00001 to 4.0.53.Final-redhat-00001
  • JBEAP-24858 - (7.4.z) Upgrade Artemis from 2.16.0.redhat-00047 to 2.16.0.redhat-00048
  • JBEAP-24973 - (7.4.z) Upgrade insights-java-client from 1.0.1.redhat-00001 to 1.0.8.redhat-00001
  • JBEAP-25004 - (7.4.z) Upgrade runtimes-java-api from 1.0.8.redhat-00001 to 1.0.9.redhat-00001
  • JBEAP-25085 - [GSS](7.4.z) Upgrade Undertow from 2.2.25.SP1 to 2.2.25.SP2
  • JBEAP-25086 - [GSS](7.4.z) Upgrade WildFly Core from 15.0.27.Final-redhat-00001 to 15.0.28.Final-redhat-00001
  • JBEAP-25204 - [GSS](7.4.z) Upgrade Undertow from 2.2.25.SP2-redhat-00001 to 2.2.25.SP3
  • JBEAP-25205 - [GSS](7.4.z) Upgrade WildFly Core from 15.0.28.Final-redhat-00001 to 15.0.29.Final-redhat-00001

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-activemq-artemis-2.16.0-12.redhat_00048.1.el8eap.src.rpm SHA-256: ce6b3d64923270f8673ceebeefe3fc094222a2e1b9ad35f59c8bbbacdd541ec8
eap7-glassfish-jaf-1.2.2-2.redhat_00002.1.el8eap.src.rpm SHA-256: 6bf571387751dfc9f8b099acf08ece4c262630b298fa750d9ab6dd7a201fceb4
eap7-glassfish-javamail-1.6.7-2.redhat_00003.1.el8eap.src.rpm SHA-256: 451ab8059faf18118997214f2dc704159787cd574f2a040bd29d9f863f079f04
eap7-hal-console-3.3.18-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 64b6a21011f39847f7bb38d76bbfb1cc5e0e6f93b678f0d7835ca77bfc523c02
eap7-hibernate-5.3.30-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 9228982f608f665c154bdb5613d0c3dc02baede489ba68fc85a5ffbea4c31f60
eap7-insights-java-client-1.0.9-1.redhat_00001.1.el8eap.src.rpm SHA-256: f12ee945543958a510aefd1b26b8d8e1bc8e6c01043fc09b07b420201c84419f
eap7-jboss-cert-helper-1.0.9-1.redhat_00001.1.el8eap.src.rpm SHA-256: bbd8f58175847b4307fab42cfc2710003cc79907c751b62935432ccdd5914a40
eap7-jboss-ejb-client-4.0.53-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 5c40421c32771d694b4afab9ba30dbba13bf11b3b16ec0346adc991b981b87a6
eap7-jboss-server-migration-1.10.0-30.Final_redhat_00029.1.el8eap.src.rpm SHA-256: 313c3946e8f5ad4f8d5325abc3518c88e8b711d4ed125e930d919cdbc8d3bffd
eap7-jettison-1.5.4-1.redhat_00002.1.el8eap.src.rpm SHA-256: 04449f1c6ff24097e59c28b32f32c8ad03ae81f2d7963eb722e5928b861f5268
eap7-picketlink-bindings-2.5.5-27.SP12_redhat_00016.1.el8eap.src.rpm SHA-256: 0ff7d968cd6b2894bf64a29108ff80417133c7ca2c78eb563a5e60d705f17d91
eap7-picketlink-federation-2.5.5-23.SP12_redhat_00013.1.el8eap.src.rpm SHA-256: c8fa0050a10bb9bc0ce5cc474f846d0c7d9e31f236cd41de466021a90f88ac06
eap7-protostream-4.3.5-2.Final_redhat_00003.1.el8eap.src.rpm SHA-256: 0b6af0468749952fa1e26ccdc96dd37a2b96f244d5765e2217f689578a9881b2
eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el8eap.src.rpm SHA-256: 7b19f04a6db4f7fbeabb50d2cf57a9be8c1d85a07a59ee0f59defbbdb4b3bfd3
eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el8eap.src.rpm SHA-256: bdaf436f769861057f0970a0d7a93193dd70431e719b24c3c0ac7667ad0caa9d
eap7-wildfly-elytron-1.15.17-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: f53803afdefd27b866454ca7cb87f17ab14966bfe520b99690b6bf980c749ef1
eap7-xalan-j2-2.7.1-36.redhat_00014.1.el8eap.src.rpm SHA-256: 065235f9ce1c738a927be96051de469b91d7788e6d98f5debbd99f93cea8ea92
x86_64
eap7-activemq-artemis-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 65119bb95eca923e78af8e4cf5f0d9c11ef97af89e9388a088eb7e0b8537a205
eap7-activemq-artemis-cli-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 88210b04a9410a7cb356cabbcd7636943d653b3223bea387524b9903ba7d0fe7
eap7-activemq-artemis-commons-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 6a0ad4b01f10a43148b134d6415fd3a0c6a82eceaaeaad2858ea404a76e7c257
eap7-activemq-artemis-core-client-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 3ea66b4b9bd6b47ba47e0c81e12d7f4720cb436a17eb9f71b17d6e143bcbf40f
eap7-activemq-artemis-dto-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 482827b8b4ad29e4a7a1e4bd980a8dd9311d6d985f4be9b20e2ee7f1e27ee15f
eap7-activemq-artemis-hornetq-protocol-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: b372b5a22dd8cab7582917ab90e4a8258d8b1c1f2f2fad2cfa1f47fadab87f28
eap7-activemq-artemis-hqclient-protocol-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: a4343340235dd3388c39d55d692a55713ee472094722046e0d0e380e58e7acd8
eap7-activemq-artemis-jdbc-store-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: d717a9aa47e4372d5e55bb24e12357814e7629c3ab8efb3b9e0cdd09b91c2aac
eap7-activemq-artemis-jms-client-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 07de8a94f3614208f3a1443410dede7e2a69acd94b6f07aabc93dbf8251c2cb9
eap7-activemq-artemis-jms-server-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 06f8ed04c77e2a7db03fd9aaf48aab167a014229301b3e48e5406e217ced5f81
eap7-activemq-artemis-journal-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: aa12e7a4a83134f9d74b01b3ec9690a4a2957926ec2c073892490b635dd6b303
eap7-activemq-artemis-ra-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 9afdadc6d3463fd304333cbedf7c4eed32ad346ab585d700b366af97436d7a50
eap7-activemq-artemis-selector-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: b9d9571abfe6222d66b23f81a24f51db1a5058d32011c69cf524813f5da2d031
eap7-activemq-artemis-server-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 6f6d0602a2bc9a6be162dc5074ee29929a5dbabfb41ad35bdfe8e5a4f06db2f9
eap7-activemq-artemis-service-extensions-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 5a03c3ad416fb30a439b57ac5891e199e9a836d83d77df948a583298252cdf80
eap7-activemq-artemis-tools-2.16.0-12.redhat_00048.1.el8eap.noarch.rpm SHA-256: 3c08c0211541c57dbc7429ddd1766071fe52ec6f46847bad1e18ee71092450c3
eap7-glassfish-jaf-1.2.2-2.redhat_00002.1.el8eap.noarch.rpm SHA-256: 81b45ee03e5fbf886e1066c9c0c3036f3220418387e8c9c7722f93d1417b4db9
eap7-glassfish-javamail-1.6.7-2.redhat_00003.1.el8eap.noarch.rpm SHA-256: ab64dfa81cac5db38f507a329122ea0a3a0da44d2750a116e74467d805227e53
eap7-hal-console-3.3.18-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3d2dc0401ea57152a7dd23b1db975c44876ae6ef89e92f1820b5770ed6ab1195
eap7-hibernate-5.3.30-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: e607b30b07c923922a7de190d6f4ff2e38603d784346755790bc696afe7542c3
eap7-hibernate-core-5.3.30-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 20f90daf2c4372f64446c924c6f384396fcc1c574a5fe1dadab55bb28baf179f
eap7-hibernate-entitymanager-5.3.30-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 89fc6a7631c7850e1c66d4d498e0bfe967bae08af89ec94da9adbb86289547d2
eap7-hibernate-envers-5.3.30-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3363b17fb198d0efa276aa1daf9a813d545938406d88e331e46350573158456b
eap7-hibernate-java8-5.3.30-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: fbf79fdb5ac172ccd89ea5c59aafc0b0e14caa26261dc941f062742f38ab62e2
eap7-insights-java-client-1.0.9-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: a3490abccea9dddd566b76de588ae8471eb2c0ad366b25a63ee8654254f5285f
eap7-jboss-cert-helper-1.0.9-1.redhat_00001.1.el8eap.x86_64.rpm SHA-256: 641d6282441409a04ea7f3b9fcef2e2aed55728a582121c92c5d6aaacea81761
eap7-jboss-ejb-client-4.0.53-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 77c8e71ebd26d58831dc8961406713be462515c8ee50421e86880130f8bc5ed4
eap7-jboss-server-migration-1.10.0-30.Final_redhat_00029.1.el8eap.noarch.rpm SHA-256: 322ae1087bbc28c70c98a96c12c6389c07185c3257a1aafa33c23dc5cfa2e7ab
eap7-jboss-server-migration-cli-1.10.0-30.Final_redhat_00029.1.el8eap.noarch.rpm SHA-256: e4727c3c008ea060d3dfd3f3e9f114ca20ca5aeae4e7c7c8ee82a65c55ae03ad
eap7-jboss-server-migration-core-1.10.0-30.Final_redhat_00029.1.el8eap.noarch.rpm SHA-256: 4c66203fc498474126e787e61c10684b2961db18e963578d8c2aaa4dc6fc5856
eap7-jettison-1.5.4-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: 1b20f03f3bfa2b6c802774f5605ba7d046de2bfee2ec8602db41e66e56360af2
eap7-picketlink-api-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 39ffa38207bcc04890a40776e90a78de879b6918dc945e7fbcbeb985d0cfef42
eap7-picketlink-bindings-2.5.5-27.SP12_redhat_00016.1.el8eap.noarch.rpm SHA-256: ac503d5ed418b2fa4b1cd040c9e5844e41d79bee49a501b730d52b97d5d55af5
eap7-picketlink-common-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 33563ca7b339c4d84c49061688f206a0e25f1bcab8a82cfb203e72960332e56f
eap7-picketlink-config-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 878732e9e8e2bfc2a22e71fadf6aff2686b86bdb77f358d18949f996aca48d73
eap7-picketlink-federation-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: d0599c2a66df66039546ca60a3fd72a76bd61718123f1ca5577a76b3fe6d294e
eap7-picketlink-idm-api-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: bceaa77a533092bcfd4e69d60af9eb55345dadada67a80f0493f1a398fbccdfa
eap7-picketlink-idm-impl-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 5af4432ac390ff472bf0e808fb8803d8e7892093fb21302dbfa592b3c8fd9f45
eap7-picketlink-idm-simple-schema-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 77399704aee7b820e19fc58d3c130d0068d34854d9c957d468f1f372c15e74af
eap7-picketlink-impl-2.5.5-23.SP12_redhat_00013.1.el8eap.noarch.rpm SHA-256: 0ce1ccdb93220fafc4cfc4fb2d0f40f23738efc945eedd342946e2465576ef64
eap7-picketlink-wildfly8-2.5.5-27.SP12_redhat_00016.1.el8eap.noarch.rpm SHA-256: 7d71d18445b201945547492a7b98630164aff82153e37beddb9d268a062fa237
eap7-protostream-4.3.5-2.Final_redhat_00003.1.el8eap.noarch.rpm SHA-256: 5d7d86e61d691526cef46af1ce5b85ef4ef3bc733da9f938074b5be9c5e535a8
eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el8eap.noarch.rpm SHA-256: f6378007f9b7c04e046c81f22474d3001350a310934dfd8deb01a1ba29cbc3e5
eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 447d9399335d1c8c4d9fa4eb718092bacf7ef689d57603f2c8ec696521a61913
eap7-wildfly-elytron-1.15.17-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: c2f48244caa7d9fabc8199e1671e098056388dde295bc63fb419619081f29942
eap7-wildfly-elytron-tool-1.15.17-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3762a7320e18833d75f39097c83842a636ff55478d5b1faf21d48ad7d6001c6a
eap7-wildfly-java-jdk11-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 243f4d76f787bec014bfd6beb63c5a5fdd51f6f9ce8161ce495e02f8e33d0b55
eap7-wildfly-java-jdk17-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 89c1298c00db253f7015c99a0211674bfaf24ed45cd92dcf86a57c4ff97731d6
eap7-wildfly-java-jdk8-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 1d8c2a7577fc9b6178855dcf3d649d35769b7c2856798dfc10cd114bf3a1b210
eap7-wildfly-javadocs-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 7d42c58b2884935099f0efd70016aafb629b89de9616361027193e78008d806d
eap7-wildfly-modules-7.4.12-3.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 5f0df7d302f3dfe7527ca3d6ce9371aab01ea0bca2bd8a0c9cbe7e0e79bb468a
eap7-xalan-j2-2.7.1-36.redhat_00014.1.el8eap.noarch.rpm SHA-256: 6fddabba381db5472e22fcacb0becfb7ef7ff0368476cc8f8b72e83df4361cdd

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.