Red Hat Product Errata RHSA-2024:3560 - Security Advisory
Issued:
2024-06-03
Updated:
2024-06-03

RHSA-2024:3560 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.17 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

[eap-7.4.z] (CVE-2024-28752)

  • eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-7.4.z]

(CVE-2024-1233)

  • datatables.net: contents of array not escaped by HTML escape entities function

[eap-7.4.z] (CVE-2021-23445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied.
Also, back up your existing installation, including all applications, configuration files, databases and database settings.
For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64

Fixes

  • BZ - 2257732 - CVE-2021-23445 datatables.net: contents of array not escaped by HTML escape entities function
  • BZ - 2270732 - CVE-2024-28752 cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding
  • JBEAP-26439 - Tracker bug for the EAP 7.4.17 release for RHEL-8
  • JBEAP-25637 - (7.4.z) Upgrade wildfly-http-client from 1.1.16.Final-redhat-00002 to 1.1.17.Final-redhat-00002
  • JBEAP-25786 - (7.4.z) Upgrade ejb-client from 4.0.53.Final-redhat-00001 to 4.0.54.Final-redhat-00001
  • JBEAP-26406 - (7.4.z) Upgrade wildfly-transaction-client from 1.1.17.Final-redhat-00001 to 1.1.19.Final-redhat-00001
  • JBEAP-26680 - (7.4.z) Upgrade jboss-modules from 1.12.2.Final-redhat-00001 to 1.12.3.Final-redhat-00001
  • JBEAP-26692 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP07-redhat-00001 to 3.0.0.SP08
  • JBEAP-26705 - (7.4.z) Upgrade jboss metadata to 13.5
  • JBEAP-26718 - (7.4.z) Upgrade Wildfly Core from 15.0.35.Final-redhat-00001 to 15.0.36.Final-redhat-00001
  • JBEAP-26782 - (7.4.z) Upgrade Infinispan from 11.0.18.Final-redhat-00001 to 11.0.19.Final-redhat-00001
  • JBEAP-26815 - (7.4.z) Upgrade undertow from 2.2.30.SP1-redhat-00001 to 2.2.32.SP1-redhat-00001
  • JBEAP-26824 - [GSS](7.4.z) JSF token generation hangs EAP 7.4 Update 15 start up in low entropy environments
  • JBEAP-26828 - [GSS](7.4.z) Upgrade Mojarra from 2.3.14.SP08-redhat-00001 to 2.3.14.SP09-redhat-00001
  • JBEAP-26922 - (7.4.z) ClientInterceptorReturnDataRemoteTestCase is failing after jboss-ejb-client upgrade to 4.0.54.Final-redhat-00001
  • JBEAP-26944 - (7.4.z) Upgrade HAL from 3.3.21.Final-redhat-00001 to 3.3.22.Final-redhat-00001
  • JBEAP-26959 - (7.4.z) Upgrade wildfly-discovery from 1.2.1.Final-redhat-00001 to 1.2.4.Final-redhat-00001

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el8eap.src.rpm SHA-256: 74a059046b48823fa5339e8dc7877a87c218593bb6a85245aaf4060e53dea0f9
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: a13d4346e8fd3b103e20dfe4357632e971d384079aba41165c16c12d920c720a
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el8eap.src.rpm SHA-256: be12340ea74919a9b22af8edbbf050908df0fb4726b29e503a4fda4150bd61ba
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el8eap.src.rpm SHA-256: b9c91d34c59c60e01719ec53f1c368eb1003393489f614fe27f77154bb128df7
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el8eap.src.rpm SHA-256: 498dc0e85ac709a0611b1cc38c73b331338e5d056a2e4a4c5d5ff522f6c8add4
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: e353147608584dcec45740bded9dd2c06867b5a54943e2c7f3bcdd33757aa343
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 1daf8e64c2081025e1730d471aa58de486cc8042322c0a807df1a3b1b3a4b87f
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el8eap.src.rpm SHA-256: 0e561f3c4c6c399437d6ec6f4ecb1bd7ecc82e09fb78f868d3355fef8ba4181b
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: 90b65127b531024bdcbfd1d9e4fce834366f65847e2f243bb7254d2d7748bc4c
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el8eap.src.rpm SHA-256: a4662ace2563cad3a160b954821e4d256fd7c29a3fdcd462e77843143ed29c3b
eap7-wildfly-discovery-1.2.4-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 4ef710e3822553c228ce04ee11e7a6e76d22ff9ee2090b88284b865bd2f51fa3
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 061dca46d3e89a7fbd50b6de45c886adc78f75e8f9ee44cdeb96044c37b6740f
eap7-wildfly-http-client-1.1.17-1.Final_redhat_00002.1.el8eap.src.rpm SHA-256: 7f581084b0932a510c6ecb085d244783a9fb60b43cf816a20f358cf871dbd263
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 92ec99840fc8476c329fafd7a038763ad11046878b520b53f6caf04663e1c524
eap7-wss4j-2.4.3-1.redhat_00001.1.el8eap.src.rpm SHA-256: 1d0a8d89b50578f1587b60c95d8945f62611c4ea6fe0a44657d64ae83e79c71f
eap7-xml-security-2.3.4-1.redhat_00002.1.el8eap.src.rpm SHA-256: 9bfd68908e4e302acb80331cb0a66f3b86d5a91d6d0096185dcb1270338aaac8
x86_64
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 5c35fec45adf9aa467a66d7fa87f3c1a3f8778663fec0a15cc6f09bf7abdf4f9
eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: bedec4d50e57413956a8e4efa1b797ff9ac5f044f046028e4ab223f9472ea35f
eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 21682b214030221c01ec95b45bf5dd90d13bfb8ae6329b6a00429480a71ed0da
eap7-apache-cxf-tools-3.5.8-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: ff337dad3aef8fb52b7c891b6677c0685bfe6811e87b4e0cd19714cd72005f4b
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: ac0f1343d2286205a6c9253eecb4bc83ef3215f2fc61c4a41529f95a1e31c186
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2ae6121b488e3da6387c3a662bfe52a50cf82ca6459e0c0db488f17019d7e67f
eap7-infinispan-cachestore-jdbc-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 871da9bc31afd13460a4d917ca6efbeff73da9ca36448afdf77404d3bec0575c
eap7-infinispan-cachestore-remote-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 9c364de443b4d4bf4a4850c1573243d93ddee3471ce09f1d99574d4fa1d2ca14
eap7-infinispan-client-hotrod-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: af078942c57e97b3dbe56d2b1918af53a3a1e3385e309e5d08097fe4e421b85b
eap7-infinispan-commons-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 133e2030bafeba7aa4a59c2879912fd5e6abd068a5fe515dae0a015d200e55e7
eap7-infinispan-component-annotations-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 62d5945bad35d00a43619f19a0ed9b5f59aca15c4af7eaf7294d6f7ff3b9467f
eap7-infinispan-core-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 410fbafa520decc48204fa64b2deb33bf7c681b120138bc55ddec92264855fd9
eap7-infinispan-hibernate-cache-commons-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1b902d1c2ff5598cc379f286325bba848d5eafbe364bb3d589e383d32bca1c83
eap7-infinispan-hibernate-cache-spi-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 63b45b7a79841f16103621f2c767b0545e0d03f2f363eb380e32a6631a91cd3f
eap7-infinispan-hibernate-cache-v53-11.0.19-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2540d7488a4b0c629206cc7155047fd1f690569ec9b3603c81bc9a102559cfb0
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 075e1a72fecc14fb0d5090d6d5cbd43e8d85b44c0eff19ecd2af11e1b532f605
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el8eap.noarch.rpm SHA-256: d8be3d40a9f775a1a90b1ce227421ac35e110825806ac60c38ef65e6c50c8277
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: d3790c58135e36f330ee40bd8ce1742ecbc30146ba57535d17ed0849901d6430
eap7-jboss-metadata-appclient-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3977ad20f7c9956dc7a152fcb46238a4189072f7db7eaa0f4299f4bc7fbc3ee8
eap7-jboss-metadata-common-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 2afc4baaa2c1b12ae5ab6a2820452a52ea73744c8413bc3570e2f0a94ade7473
eap7-jboss-metadata-ear-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: a425532f6125e6485e71b64eac418cc1d0ea5b205a3e2584326829ff25e92a18
eap7-jboss-metadata-ejb-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 4fa8e64b1f2243eb617d31134b8910b18b1ff014676aa0bd96e9ce4d2b2472a7
eap7-jboss-metadata-web-13.5.0-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: db16705e6bed70ca1a89bc777dd6c435765c637c4b23293af0f3cc76c884e68d
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 854a7a9c8d4ccfe53b98253cc064d08f7ee52079e33ae7c24925103b5ecd5b74
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el8eap.noarch.rpm SHA-256: 33770f7fdf3e1f5f37e330ed40475951ac5b19af58d064b5d5163e9a404965a7
eap7-jboss-server-migration-cli-1.10.0-36.Final_redhat_00035.1.el8eap.noarch.rpm SHA-256: 3863e6114ad60b49eff859d5ace30ca334f20475efac1154c9186e1afbc78dfc
eap7-jboss-server-migration-core-1.10.0-36.Final_redhat_00035.1.el8eap.noarch.rpm SHA-256: 80bcbc26f75f87272d0a9f3947846e2f1651be14e41d408589b659edb66179f4
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: 01314964b5b10215fc0881807cc88ab31991e67c17ea9d9fe9c3dd8916fa6b3f
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 0047a04725a3c0f7728e83982674b94f85787726d167ec6bfaf9e96ff6990ee5
eap7-wildfly-discovery-client-1.2.4-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7bddaa02f63dba94ba71764705fb8e5e7e89d27102ccffe80ce8e475d90869d7
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 5cdd532c8cd34df404ae3e1e3268281fcdd72672db436a6ef9b5d6c9655d205a
eap7-wildfly-elytron-tool-1.15.23-2.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 377d1a22b000b42e11ea5105fd18fb88355db4dcdf8758dbbaf7574ba947f5cf
eap7-wildfly-http-client-common-1.1.17-1.Final_redhat_00002.1.el8eap.noarch.rpm SHA-256: 8901a768206bc98629670e9b35f872b763b63dc2e104f759c2a1fd754b1a4317
eap7-wildfly-http-ejb-client-1.1.17-1.Final_redhat_00002.1.el8eap.noarch.rpm SHA-256: 2af219a849b84a43b61e3ff4a57aed4ef7bcb8aed2f6e45c52d203bda199867e
eap7-wildfly-http-naming-client-1.1.17-1.Final_redhat_00002.1.el8eap.noarch.rpm SHA-256: 7faaf10816cab83976cd9949075045e80f3cfd2e55bfe5fab3b90b0d97959367
eap7-wildfly-http-transaction-client-1.1.17-1.Final_redhat_00002.1.el8eap.noarch.rpm SHA-256: fc89c2d84344d20a72e08a5512c6a417b8f7c93ea1e137ffaef5483a42556938
eap7-wildfly-java-jdk11-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: f4daff3c8745ae36def7f590f3541890ddbc47ededf715dad32eaf34e642e20d
eap7-wildfly-java-jdk17-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: c130f88f1c28e21a3393848642afc6f0ef25a267dfacd7e39acf8344e5210be8
eap7-wildfly-java-jdk8-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: d3acf10871c63a596c138c14b5745ed6b5f0be735f1a8074f2aa011e21542866
eap7-wildfly-javadocs-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 265a4d592da84457fb415ea8fc15feca621a6e22fbb98094f5829dfda4077a5a
eap7-wildfly-modules-7.4.17-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 163e6dcaea0b47a8ea51c5b1a22fd5bc92a6a9efdc5c8310be1e7bef7bafa625
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 3c611af1b6c0ae91108f437da79b837019eabb8ec348429e489946cf28c1d69a
eap7-wss4j-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 4071780d157b5179c12aa80b329fff40efd85c235ebbd5252d13c250b2d2fecb
eap7-wss4j-bindings-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: a8d151d6ea0a63a86ed3d983d753a7a8da8c64b84a9480aba65b6de8da2052b9
eap7-wss4j-policy-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: abf20861201ddf38a3d63677faa63133cfcf234a62358ae37f5fb071a0dc3be1
eap7-wss4j-ws-security-common-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 99ac26c9dae7cef1dec4c3bb906049aebb5219a02a66f19f4e6b6d4d64cea135
eap7-wss4j-ws-security-dom-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: b3b7a22848ca1802cdd4d9e80a90823315267c4ddb80e27f907b6f575cab8699
eap7-wss4j-ws-security-policy-stax-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 99d6f97d6e1cd9dd9f850212683499c92a5ba8b7f48035184a9225dcce56b0f1
eap7-wss4j-ws-security-stax-2.4.3-1.redhat_00001.1.el8eap.noarch.rpm SHA-256: 4affa593ec3a07a5c3bfbd6131ace63ec4d6b1f29bcf18798a18b78be2a76ef7
eap7-xml-security-2.3.4-1.redhat_00002.1.el8eap.noarch.rpm SHA-256: b6d3237c2c75360e28384cf03b0ec990e38a29f78e35095ace09ed8a99475fdb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.