Red Hat Product Errata RHSA-2024:1192 - Security Advisory
Issued:
2024-03-06
Updated:
2024-03-06

RHSA-2024:1192 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 8.0.1 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.0.0, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.0 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • jgit: arbitrary file overwrite (CVE-2023-4759)
  • sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)
  • parsson: Denial of Service due to large number parsing (CVE-2023-4043)
  • apache-sshd: ssh: Prefix truncation attack on Binary Packet Protocol (CVE-2023-48795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings.
For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 8.0 for RHEL 8 x86_64

Fixes

  • BZ - 2238614 - CVE-2023-4759 jgit: arbitrary file overwrite
  • BZ - 2240036 - CVE-2023-35887 apache-mina-sshd: information exposure in SFTP server implementations
  • BZ - 2254210 - CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  • BZ - 2254594 - CVE-2023-4043 parsson: Denial of Service due to large number parsing
  • JBEAP-26209 - Tracker bug for the EAP 8.0.x release for RHEL-8

JBoss Enterprise Application Platform 8.0 for RHEL 8

SRPM
eap8-apache-sshd-2.12.0-1.redhat_00001.1.el8eap.src.rpm SHA-256: 517fef890a84e4a254e2531e92000204da9a18494403d2190c8f658e0d3941f9
eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el8eap.src.rpm SHA-256: 27c38e7bbefe40a55a664b2c559a6ebc6582926665f1d269f564d111cacf7c74
eap8-log4j-2.19.0-2.redhat_00001.1.el8eap.src.rpm SHA-256: d6057ca0f3f7ad9fb5063789d622f9938f20e225f6808996aedfffcea8c58e90
eap8-lucene-solr-8.11.2-2.redhat_00001.1.el8eap.src.rpm SHA-256: 2d0aca245d92cb4e91106037445fbb285685f9f013feab14d34c4d2f4bcc52ab
eap8-parsson-1.1.5-1.redhat_00001.1.el8eap.src.rpm SHA-256: 540acc690a051942e9dcc57fccad07dbdab541f42822b187374d0dc2fd8b3c69
eap8-wildfly-8.0.1-3.GA_redhat_00002.1.el8eap.src.rpm SHA-256: d3930770b66f978a7fc0830ec52d4132a9bd0fe312c61852db44ab6c81a3ea3d
x86_64
eap8-apache-sshd-2.12.0-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 02afe8ec57f73a96598ee6239bcc3a0b1edfbd7fcb7abae0de9cf3815777effe
eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el8eap.noarch.rpm SHA-256: dc2b175f74b64a318571bfbdc43ff7261a85f47c40840b08c18b07cf1e8307fe
eap8-log4j-2.19.0-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: b4878820812390820f0b1733600e49e5fd9a8041778323b9d7118a5bce5ac38c
eap8-lucene-analyzers-common-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 0bc25014448cd6bd2d0fe507b909fe2655bd022bce5d5f78360cb024713d47fb
eap8-lucene-core-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 13ceeb72a77dadf3ae0964e4761afaebbc94d68491dee999e9efc192598c7580
eap8-lucene-facet-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 78b27b6b83158475b1214d72ee643533e80b3144b68e52c3fd3d48b5f4de5e2d
eap8-lucene-join-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: d5cf9d79ab9668ee8f494dca14065837eed0c0fb8991bc8d0b8e95ebb91f6b4b
eap8-lucene-queries-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 0b68fedcae57e405d58bb5a10133488b013aefab1018612bb524388b25391e09
eap8-lucene-queryparser-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 3dfee3a3a9d87b3362b11c18921e99278f6303a96383dda923cdd026ebe25f9f
eap8-lucene-solr-8.11.2-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: 50713ea94ad61a8f3444176fe2a633cbac6908e43c7d60ce082ecda9cddf6729
eap8-parsson-1.1.5-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 9504dd09d895e1a311a7e1fc7631cd6140a03827a5188a93b283da55764d8260
eap8-wildfly-8.0.1-3.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: b2ad17cf10f333fbaaa69268815967fb96e3286f23769f9439acea5a4a5f2f91
eap8-wildfly-java-jdk11-8.0.1-3.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 3a5af2bc9e93ec86e98368c665672247adfe114764aeed725b5eb9518ff2abb3
eap8-wildfly-java-jdk17-8.0.1-3.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: b7af4267d56aa7cf23355859d852b0470f59f8f23ee19c4734e82cc33b84db82
eap8-wildfly-modules-8.0.1-3.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: a2133257c56bfaa4d2e2d1fb8f6de210ef45b7cbc5ba579caa3a81c327b0f1b1

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.