Red Hat Product Errata RHSA-2024:1193 - Security Advisory
Issued:
2024-03-06
Updated:
2024-03-06

RHSA-2024:1193 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 8.0.1 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.0.0, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.0 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • jgit: arbitrary file overwrite (CVE-2023-4759)
  • sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)
  • parsson: Denial of Service due to large number parsing (CVE-2023-4043)
  • apache-sshd: ssh: Prefix truncation attack on Binary Packet Protocol (CVE-2023-48795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 8.0 for RHEL 9 x86_64

Fixes

  • BZ - 2238614 - CVE-2023-4759 jgit: arbitrary file overwrite
  • BZ - 2240036 - CVE-2023-35887 apache-mina-sshd: information exposure in SFTP server implementations
  • BZ - 2254210 - CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  • BZ - 2254594 - CVE-2023-4043 parsson: Denial of Service due to large number parsing
  • JBEAP-26210 - Tracker bug for the EAP 8.0.x release for RHEL-9

JBoss Enterprise Application Platform 8.0 for RHEL 9

SRPM
eap8-apache-sshd-2.12.0-1.redhat_00001.1.el9eap.src.rpm SHA-256: 8e8c182058e89aab46cfb37d162af7f5b16536d16963c6f6af7d421c0abf53f1
eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el9eap.src.rpm SHA-256: 196a501d34b454bbdff603bc6bde3eb0821f14b797a0601cab64cafb73e178e8
eap8-log4j-2.19.0-2.redhat_00001.1.el9eap.src.rpm SHA-256: 9ba135db62cbd295f87a5e840c03ab6525afa457d3e7c58eb630f4f565fe75ed
eap8-lucene-solr-8.11.2-2.redhat_00001.1.el9eap.src.rpm SHA-256: 82d0ae5d8ce0266e41d87f9d62e66ed39e85a4c40cc8e2c6e5f2d16eaea0e777
eap8-parsson-1.1.5-1.redhat_00001.1.el9eap.src.rpm SHA-256: 6764cc860f51521ab37ff216a63f81a953c6e8fab9b902fed78819f414d8f850
eap8-wildfly-8.0.1-3.GA_redhat_00002.1.el9eap.src.rpm SHA-256: 967eee9c7f837d77a0c4514e90633fb1e9cbe73e48f1aa349a39e655d54c9e2e
x86_64
eap8-apache-sshd-2.12.0-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 72910d65ea2036ca4d08fe6b3d7e886ab4f0fa6deeff07118b02fd83f6fbee66
eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el9eap.noarch.rpm SHA-256: 24ce4e2535ff467a02d3b110afcf5eef2661a462360ba44f237936e94b74acd7
eap8-log4j-2.19.0-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: bfbf0fbf604f564130a98a5db5ab7cf899e0c8c5e35754bf6e098d3f1c8d44e7
eap8-lucene-analyzers-common-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 4432ade7771d67f75e5fcd0cc036dca57919bed7c400d0b175f15b13091f9ad0
eap8-lucene-core-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 82b30aa10e482427abfa4236175ed9271711315d80e023e804168df088cfbad6
eap8-lucene-facet-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 0624bcbf2f3bebfd7c6f1021e50ccc1ea9b04de3100fdcf7826bdff3e5f69aae
eap8-lucene-join-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 27d6df28b165a8f65589e51b0cbdadf2897c18a6a6999dc2bdd341c709bfafcb
eap8-lucene-queries-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 76a7888681b7be1dcb1a6acbb47be601961b1d27ac6a34881264e82ebd452399
eap8-lucene-queryparser-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: d4d13c0a7063e99b11d82abfeba236ac2753aec5734345239fbef392a88c9d12
eap8-lucene-solr-8.11.2-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: 5df769509651a7ca4000da055d84329f59941c88d2e9be01ef35df565dac1cd8
eap8-parsson-1.1.5-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 9b1e20d638404db3210430e4388598567e2467d9243b29ce8e7628eef7146d01
eap8-wildfly-8.0.1-3.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 8e54c17ad5761e745a45fa993685dd11bf13e35010842c6d372c8378d15d3adc
eap8-wildfly-java-jdk11-8.0.1-3.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 20664fbbf6590dfd890daf3ec4f0c572ccb1bd434a92b17a67815ff9de3b4126
eap8-wildfly-java-jdk17-8.0.1-3.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: b4797daaf82020f6b285cb9ae5d5ab050579924b07cc37248b97a657080a5fa2
eap8-wildfly-modules-8.0.1-3.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 567dc4126f35e392f0730b227e7bf3c61f15256965f66e20d7f8148496b36c77

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.