Red Hat Product Errata RHSA-2024:3559 - Security Advisory
Issued:
2024-06-03
Updated:
2024-06-03

RHSA-2024:3559 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.17 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding [eap-7.4.z] (CVE-2024-28752)
  • eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-7.4.z] (CVE-2024-1233)
  • datatables.net: contents of array not escaped by HTML escape entities function [eap-7.4.z] (CVE-2021-23445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64

Fixes

  • BZ - 2257732 - CVE-2021-23445 datatables.net: contents of array not escaped by HTML escape entities function
  • BZ - 2270732 - CVE-2024-28752 cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding
  • JBEAP-26438 - Tracker bug for the EAP 7.4.17 release for RHEL-7
  • JBEAP-25637 - (7.4.z) Upgrade wildfly-http-client from 1.1.16.Final-redhat-00002 to 1.1.17.Final-redhat-00002
  • JBEAP-25786 - (7.4.z) Upgrade ejb-client from 4.0.53.Final-redhat-00001 to 4.0.54.Final-redhat-00001
  • JBEAP-26406 - (7.4.z) Upgrade wildfly-transaction-client from 1.1.17.Final-redhat-00001 to 1.1.19.Final-redhat-00001
  • JBEAP-26680 - (7.4.z) Upgrade jboss-modules from 1.12.2.Final-redhat-00001 to 1.12.3.Final-redhat-00001
  • JBEAP-26692 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP07-redhat-00001 to 3.0.0.SP08
  • JBEAP-26705 - (7.4.z) Upgrade jboss metadata to 13.5
  • JBEAP-26718 - (7.4.z) Upgrade Wildfly Core from 15.0.35.Final-redhat-00001 to 15.0.36.Final-redhat-00001
  • JBEAP-26782 - (7.4.z) Upgrade Infinispan from 11.0.18.Final-redhat-00001 to 11.0.19.Final-redhat-00001
  • JBEAP-26815 - (7.4.z) Upgrade undertow from 2.2.30.SP1-redhat-00001 to 2.2.32.SP1-redhat-00001
  • JBEAP-26824 - [GSS](7.4.z) JSF token generation hangs EAP 7.4 Update 15 start up in low entropy environments
  • JBEAP-26828 - [GSS](7.4.z) Upgrade Mojarra from 2.3.14.SP08-redhat-00001 to 2.3.14.SP09-redhat-00001
  • JBEAP-26922 - (7.4.z) ClientInterceptorReturnDataRemoteTestCase is failing after jboss-ejb-client upgrade to 4.0.54.Final-redhat-00001
  • JBEAP-26944 - (7.4.z) Upgrade HAL from 3.3.21.Final-redhat-00001 to 3.3.22.Final-redhat-00001
  • JBEAP-26959 - (7.4.z) Upgrade wildfly-discovery from 1.2.1.Final-redhat-00001 to 1.2.4.Final-redhat-00001

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el7eap.src.rpm SHA-256: a88a6c8e090bbbbb22b818ee35801d82fef1eb325f7f7d3869e58ed4aee61b60
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 1c51336b262066037d41650a150f9746485cf4588ee1cf11ef1cb4865118de3e
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 8c8b9e38cfd41c11e54d69688dd17741a07adbfff763f6f7f1a1bb5604711aec
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el7eap.src.rpm SHA-256: bf8a15287e6c4cb8ea43d691f26d52f886e058b071fbf134ae914ffafd3e7911
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el7eap.src.rpm SHA-256: 20c6b15b81c0434f88c16878bc481a8665e11d9863cfa4db174f2c43aae9e3b0
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: c37b412ce8cbf3578adcaa63437a4b541078054465e41a7eec9dc041407c01f2
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el7eap.src.rpm SHA-256: f81e0c8f9c3b6441dcc492637861684989c7c75c955e7107428c7c3eb1cbdcf0
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el7eap.src.rpm SHA-256: aae987d29007a2d5c054a0646a2d8b6f0245c9cf862ef75da93b14050a4122ef
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el7eap.src.rpm SHA-256: a844c991cfdf5cded06400b6d5f9b45b206a856572dcc122ef537218582bc523
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el7eap.src.rpm SHA-256: 801972b3b6a2f0b27e8ade535c7fad72f5936a5fa7f1957806b0238dc5ca297e
eap7-wildfly-discovery-1.2.4-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 8cebbbffd63d1c5ce2367c875964ca4e17eae597cee82bdf259fecf79dde2596
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 8f71049f486a2281eabe43f2cda2cbf8edab34e290161736200fc2a8f895c307
eap7-wildfly-http-client-1.1.17-1.Final_redhat_00002.1.el7eap.src.rpm SHA-256: 444fb00424c33b97533df74c6956d9eb1cfbdcd24b86e40a659c96f7c9f93844
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: 6d212556c7775d04328da4ad7128f483ce8eb4739f556135e042005d584a8bc2
eap7-wss4j-2.4.3-1.redhat_00001.1.el7eap.src.rpm SHA-256: ce5c0c5347967101062f69017f7a40dfe302b86fad147a0975d4ec87089a66af
eap7-xml-security-2.3.4-1.redhat_00002.1.el7eap.src.rpm SHA-256: e2611b825234419b6a9d4513e768f5d51c55c3b3d59265cf8b5a4b658bfb9543
x86_64
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 3891c578ca2024532ce836c7a2dad7eb48ae839c6079f0b33853d2b580a74618
eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 06532aa9df3df566d6a29f456e35e3ea12905e66c46468b44a1e0fe65ac636a9
eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 14d5c3558ee6116d189043f583ec12b68a56ef4ed23ca0097a64b5b5c9bd5550
eap7-apache-cxf-tools-3.5.8-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 2332780480936dd6030f12f736a27fa4022f368348c9e2698c63da69e4df2781
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 43472b4b9b38d8d2f3e0ce3d405ce02042a8ac7c0291ea4a9fb577bb526a18a1
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: c2e197443d849d7900cd635f20f89165b4babc3486868ebc2e860666e30a7f4f
eap7-infinispan-cachestore-jdbc-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1ebd0f7341555be85de9a32517e2d0fa452b9ebcc3c6392139a048e32b105cc3
eap7-infinispan-cachestore-remote-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: bf96dabe7f4b4befda0ecaadc975356b917a5a6167f1311b558d9d866d9f005f
eap7-infinispan-client-hotrod-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: cf5b5730b43c902999811428f4257311da8e86bf4e6ca8e016bb61bfabe0c5f1
eap7-infinispan-commons-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 7f72d800dc7487dc1df57a32837954079a9d9f612cce79d06f27d9376c2bd51e
eap7-infinispan-component-annotations-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 38f39a9dddd6d5252ceea6785e349ecc80745b1f788811b53dd0c34d8cfd1ab8
eap7-infinispan-core-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: d5e1bccf144d231e2a8ad36eccee9cddd226bf6e24e27ed51cb2edc5d61a8569
eap7-infinispan-hibernate-cache-commons-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b7a60601f6e254c4b794a3e7931c3f7cb70d10e17b9b91b66e791db754990247
eap7-infinispan-hibernate-cache-spi-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: acf1e3da6427df6972d94b201b4b72583753d3cf66bbad236ee9fd15064ddb69
eap7-infinispan-hibernate-cache-v53-11.0.19-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: c2618861aa213e8a8b0bad6fb26693321adb74302b92788228c435d2ab4a3b4c
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: e6ce89cbf555eadabe22cfde5c139857bf60e4c10e72b502c619fb18adfb8277
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el7eap.noarch.rpm SHA-256: dcdd2bc40fb50c9dd87b835df3cda548d4d5ddf31d6e306b5427c78553edc6f5
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 246fc55f50a8e495185bf9d305f92d8a8954636b9eb6c462481aad939ca92fe5
eap7-jboss-metadata-appclient-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 19ef1bb00fdfdb431cbe75fd3b8d12b320c3110c81de373167474e51163415de
eap7-jboss-metadata-common-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: b44b7097b2bba28f52ccbbbf829253d4f76804538d9f4f21105ffb14c069a3f5
eap7-jboss-metadata-ear-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 6930e63eb07f2b77b5ed7f59d46d19a93bc2ae7dc095791ad13222262bef9d87
eap7-jboss-metadata-ejb-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 60ebc103145b3210baf9c674d2aa3482f720208eb5c7676f3ff8869d299af9a7
eap7-jboss-metadata-web-13.5.0-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 604cef2f8fcc72051daff3f552225fb756af37d07aceebd2b68b8bdd7a2b1444
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 5ea473e9b00dbe7176a44da46cf4423fa1ce5df8f3707aa94fa8a81e66a49bc1
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el7eap.noarch.rpm SHA-256: 9be0ab601e2bc26011c57da7bf80c7b07fbc0a90f23cbf01fc70c616eb5fc39d
eap7-jboss-server-migration-cli-1.10.0-36.Final_redhat_00035.1.el7eap.noarch.rpm SHA-256: f1c9d562b1a5f4b801152570d05b50566033a4752cbc74827190a0f9ef09ee22
eap7-jboss-server-migration-core-1.10.0-36.Final_redhat_00035.1.el7eap.noarch.rpm SHA-256: 98eaa1e611a57512bd28dc280e2345c2fbd93532947bf1a914d52ba558a565fc
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el7eap.noarch.rpm SHA-256: d3e61edc1f6151948a5bf8b82620894781d15cb9a615ff809850d289bcb38cea
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: f29e4acfd9f2f67d465d94653082f9b9eb24df9f70e229e4ca6cacba3949b5f6
eap7-wildfly-discovery-client-1.2.4-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 023cb4d79677c87eae4c675835a2f67015ffd667bf3ad30a7222d0aadd14783b
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 4b951cd69422c851c7fba19b754682acb4a6242eb0a0e9f8d0526372e58d2c5b
eap7-wildfly-elytron-tool-1.15.23-2.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 2d72ae715c3dcdf1ce979170afe64cbf8b866bed13d542e978c2719b304842cd
eap7-wildfly-http-client-common-1.1.17-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: ff73c1fbcb0201c39bb153a345e7ee31770b84b206c4531640fd6285e4a1b36c
eap7-wildfly-http-ejb-client-1.1.17-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: 6248fcd593e8d8fb011de367f341a2a1de7fcadd98c141f4acf4e563a2866d4b
eap7-wildfly-http-naming-client-1.1.17-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: 428afe69723f54229dcfe53d9cf524e998ea9f95c66ca54667d11990df1e56fd
eap7-wildfly-http-transaction-client-1.1.17-1.Final_redhat_00002.1.el7eap.noarch.rpm SHA-256: 8c0f04e4b12fbf2fdbecc4ca80f318aeec5d7cf283d3c9d37f35b4f5130d70b2
eap7-wildfly-java-jdk11-7.4.17-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: 31ca33ccf38b43f184066a95dd75454f4daa140abedc95463b94617f46de17a3
eap7-wildfly-java-jdk8-7.4.17-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: f22734e092aa41c968ff316f941d244ef64eac43c14314ec652158cf1c6a5517
eap7-wildfly-javadocs-7.4.17-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: 131c9824f886b6c943ad5c31235b9d4e861bed8ea8334ac77a6778ab40e21378
eap7-wildfly-modules-7.4.17-2.GA_redhat_00002.1.el7eap.noarch.rpm SHA-256: a26270dbf949eb6d23ec9b635485e642041120da8a592b2bf12084ada968e4ea
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 9949a00f1c0940fa7f9620708226fa574580953f77c025fe8a7f356949191e10
eap7-wss4j-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 7b52f983d74a0beabf20ac0a246112e3eb7c89c8b84e8fc1c83c46a7d34b6e63
eap7-wss4j-bindings-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 3b2c0ce7b0058fce6e77c1fcdb9b569ac285b5d7a40128018b20b5070c725c51
eap7-wss4j-policy-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 91a795f1468b711c2adfd7d5a0efe16a2bedd1c2e6e7bc691a1f69cf457151d2
eap7-wss4j-ws-security-common-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 2694383095f4b38a787195f90613264ee326a59f10b90eb71a73ab13489fd4d4
eap7-wss4j-ws-security-dom-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 997d0a357600408973980f72e77ebe298ee8843c564328bc4003abd91ff7f23f
eap7-wss4j-ws-security-policy-stax-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 6273e62423b07966f4ff1b3e35f94d47c2559e236f5d0dc8237de451927d1a32
eap7-wss4j-ws-security-stax-2.4.3-1.redhat_00001.1.el7eap.noarch.rpm SHA-256: 03aff676ebd9c142a258755dfaaee55aa3736d5646d6de5452bd353fb6ff13fa
eap7-xml-security-2.3.4-1.redhat_00002.1.el7eap.noarch.rpm SHA-256: b8906b6bc83699f81bcf8816b32139afbcf803a85b785981eba7ae3ff3db67f1

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.