Red Hat Product Errata RHSA-2024:3561 - Security Advisory
Issued:
2024-06-03
Updated:
2024-06-03

RHSA-2024:3561 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.17 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding [eap-7.4.z] (CVE-2024-28752)
  • eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-7.4.z] (CVE-2024-1233)
  • datatables.net: contents of array not escaped by HTML escape entities function [eap-7.4.z] (CVE-2021-23445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied.
Also, back up your existing installation, including all applications, configuration files, databases and database settings.
For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 9 x86_64

Fixes

  • BZ - 2257732 - CVE-2021-23445 datatables.net: contents of array not escaped by HTML escape entities function
  • BZ - 2270732 - CVE-2024-28752 cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding
  • JBEAP-26440 - Tracker bug for the EAP 7.4.17 release for RHEL-9
  • JBEAP-25637 - (7.4.z) Upgrade wildfly-http-client from 1.1.16.Final-redhat-00002 to 1.1.17.Final-redhat-00002
  • JBEAP-25786 - (7.4.z) Upgrade ejb-client from 4.0.53.Final-redhat-00001 to 4.0.54.Final-redhat-00001
  • JBEAP-26406 - (7.4.z) Upgrade wildfly-transaction-client from 1.1.17.Final-redhat-00001 to 1.1.19.Final-redhat-00001
  • JBEAP-26680 - (7.4.z) Upgrade jboss-modules from 1.12.2.Final-redhat-00001 to 1.12.3.Final-redhat-00001
  • JBEAP-26692 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP07-redhat-00001 to 3.0.0.SP08
  • JBEAP-26705 - (7.4.z) Upgrade jboss metadata to 13.5
  • JBEAP-26718 - (7.4.z) Upgrade Wildfly Core from 15.0.35.Final-redhat-00001 to 15.0.36.Final-redhat-00001
  • JBEAP-26782 - (7.4.z) Upgrade Infinispan from 11.0.18.Final-redhat-00001 to 11.0.19.Final-redhat-00001
  • JBEAP-26815 - (7.4.z) Upgrade undertow from 2.2.30.SP1-redhat-00001 to 2.2.32.SP1-redhat-00001
  • JBEAP-26824 - [GSS](7.4.z) JSF token generation hangs EAP 7.4 Update 15 start up in low entropy environments
  • JBEAP-26828 - [GSS](7.4.z) Upgrade Mojarra from 2.3.14.SP08-redhat-00001 to 2.3.14.SP09-redhat-00001
  • JBEAP-26922 - (7.4.z) ClientInterceptorReturnDataRemoteTestCase is failing after jboss-ejb-client upgrade to 4.0.54.Final-redhat-00001
  • JBEAP-26944 - (7.4.z) Upgrade HAL from 3.3.21.Final-redhat-00001 to 3.3.22.Final-redhat-00001
  • JBEAP-26959 - (7.4.z) Upgrade wildfly-discovery from 1.2.1.Final-redhat-00001 to 1.2.4.Final-redhat-00001

JBoss Enterprise Application Platform 7.4 for RHEL 9

SRPM
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el9eap.src.rpm SHA-256: 0c73a4b2d542a5dbafae63693e8dc997cc1bdf75476217d45fb733670da6db44
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 42947e4eb66080d8f34d13df409ba92c74a281901f2fea7943818ca1c3273dbb
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 65b9e9a3015345d9bd297cdcb12b070d62abf38de985e2d33c60eca23ae97479
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el9eap.src.rpm SHA-256: d1b40908ebd333ac6622aaf56ddc61d4384c32f5d52971a777bf33ec5d77a13d
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el9eap.src.rpm SHA-256: 7f56ec59000b67cb5c645bc113c2cd1a0e1f03ec7f7ed508240088f20770c053
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 9b3f151021ccb56dbf5ac150c55ccc71e73849ed095cb091b1a8213a23b968d7
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el9eap.src.rpm SHA-256: dcc3d7e0b7ea96879931bccb964cac36bf20f758095ee675147ec2c5ecb506e4
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el9eap.src.rpm SHA-256: bb2ac1b271a0c8a0667423f780a733ca966d706e4669a76eea5c9753f3583ba6
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el9eap.src.rpm SHA-256: 430299e32b751abe7de6b05523d1d699d5fd91156d39509a87a765c02d7b3b7e
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el9eap.src.rpm SHA-256: 904f93439a952189f88bb66a58f92bb43a58d68697ad4430e03783fb70dcef47
eap7-wildfly-discovery-1.2.4-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 87c6b0e28c3afc6934d4fd76f84e7e2837fc512d8f8b2d16ac14bde09117c5e1
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 07e097fe219b983ae026ce4d11e270be0ae5cf428e4e00309a9043d575ab63c8
eap7-wildfly-http-client-1.1.17-1.Final_redhat_00002.1.el9eap.src.rpm SHA-256: 4fded98d908140a209604410ffc6c27a1ae9644e393e761e38f750cb85259eaf
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 70b68b7dfe3ae62f12ec80bcc0113e1931e774027dd3566dc9b7073d2c3fd329
eap7-wss4j-2.4.3-1.redhat_00001.1.el9eap.src.rpm SHA-256: c21c0ac2d97f30da0a3a54bcaa365dc2c0a62cedc9f418853dcd45aa069d41b1
eap7-xml-security-2.3.4-1.redhat_00002.1.el9eap.src.rpm SHA-256: 0dbd70c43559f871735d466ccfdd111f5daddf1c828d7629d3277d2d458384d7
x86_64
eap7-apache-cxf-3.5.8-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 74e214d807bca6380f116b088f67864d260cfaa0b1b16101fdef0c06e81c27a4
eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 0eebf4b68da6d409d52ca92a8978a4bdd6fc6f61e12bd039045f029eb7a53ede
eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 704b2bdc3dc2d930de5d3427c5d863d0a531b61d66e3b3dc98ddb6200d138c23
eap7-apache-cxf-tools-3.5.8-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 783ff24c6adefc3370d13400fbc7c0c01ecdec8b6ea97a954c52add8096d44b2
eap7-hal-console-3.3.22-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 04e2a90654e6e79ff11e03db727b0f705fc73b8c8a1b57c8fcf104cff6771e3b
eap7-infinispan-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 29c732e5376f93f996a32c76ee5ebb9d5a61c6687662c61b41737e7d37ff3f50
eap7-infinispan-cachestore-jdbc-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: be59acceb8f88707caad125d405ca7a14b2d91e9c434635078353b96a1d2090d
eap7-infinispan-cachestore-remote-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: c81af406c8f235ff7ebf1f8e5977633386617620b167aa7f23d0c4f1dfd90ba2
eap7-infinispan-client-hotrod-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 928f9164b17974556c3930122f93890603a3b6eea165696c58b051fc0832d172
eap7-infinispan-commons-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 7157daa507179c28405a9278ed6eca0b78042aea9f4764d9bf812e563888868f
eap7-infinispan-component-annotations-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: afb2a129df6e9f71db45bb4367fa5515335bfda01158d8d776abc56652042582
eap7-infinispan-core-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 00baa8e0f3e51607664eb69ac3becaeb4c52b1aa52262f53df11aff006e1d1bb
eap7-infinispan-hibernate-cache-commons-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 12b56e3de69ab98855976fc290ed65502d714d44c23e53aea81abd4c793ce678
eap7-infinispan-hibernate-cache-spi-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 49838fbe0f616e6db391833bbb81c59073d51faa93c5073c805297731a7cbbf4
eap7-infinispan-hibernate-cache-v53-11.0.19-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 12de2ea5b0fa14fae00f43e05635a55cd8ec37c376d81b276c11b18c4cf5fb4e
eap7-jboss-ejb-client-4.0.54-3.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: abf223df910fa2909f2f816c2e3df7139e7d3c8f73d394e8b10a1fea39f18c2d
eap7-jboss-jsf-api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el9eap.noarch.rpm SHA-256: 02a8e843bc67630b563f6e89bfd1f33812eb377d2a136fbb3966e75fdb497898
eap7-jboss-metadata-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 2af8980a2aeb24d4755bb081568ef966e0397041fb9f9d335be923cf1921f236
eap7-jboss-metadata-appclient-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: a6051d41c8f276532f8aee3d31814d3643427fa69c0cf7970f43fd0cad061c18
eap7-jboss-metadata-common-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 7cdd117898d5b8e63aa9bb02f953caee8d542868e94e50adb645de5493d1578e
eap7-jboss-metadata-ear-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 5daa85fb8b8aade86474ddd85fdc9db181ddc6234625bf7e3dbe29da545520cf
eap7-jboss-metadata-ejb-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b495cafebfa8866903a4b414cb619205a271de79d59763f702414a8462eb4b73
eap7-jboss-metadata-web-13.5.0-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 45418fdcc96f0ca66e97eafb6588de038ae5dc99ff6b3a3d50433c2894a09fdf
eap7-jboss-modules-1.12.3-3.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: a7165057acf3329729109b30f59c2de736b2a8ad9e32578f4ae1b79de5493c08
eap7-jboss-server-migration-1.10.0-36.Final_redhat_00035.1.el9eap.noarch.rpm SHA-256: abd9f78a34acedbd764b452058e693f582d05d2798c3ae71e9d9c38406c7c5de
eap7-jboss-server-migration-cli-1.10.0-36.Final_redhat_00035.1.el9eap.noarch.rpm SHA-256: 0e82171cb950d8ea15b95dcfcbf4db83c731414408f32e84c89aac4ff1f8beac
eap7-jboss-server-migration-core-1.10.0-36.Final_redhat_00035.1.el9eap.noarch.rpm SHA-256: 1cf56afde45ed833b3f04906520112cad26246266ede6281827499cc588ed8d8
eap7-undertow-2.2.32-1.SP1_redhat_00001.1.el9eap.noarch.rpm SHA-256: 2d29065da5e39f34c6c7c3c53f2ebcbc3ca9f15466788a88ee33382b2b4964f2
eap7-wildfly-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 4c8f453e752e5dae296e9de8474f1cf8747ae9cd4f216709fb95ebb2c20d7873
eap7-wildfly-discovery-client-1.2.4-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b647180fcd3235a97ae97c82281089ef564a4caad9343b57886279aba91b22c2
eap7-wildfly-elytron-1.15.23-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 3f3950a97785c20c2e76c03d0629ed0d915e83d5f4585a66aff712aa7bc7445c
eap7-wildfly-elytron-tool-1.15.23-2.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b6d7b4a702b02d5563240cd69fe4fa2fdb3b22a2ab03a1f57663ac0d569a64f1
eap7-wildfly-http-client-common-1.1.17-1.Final_redhat_00002.1.el9eap.noarch.rpm SHA-256: 86846909bab220caf558eb6e6978159f3254d8de3ee9b2982028cbf11b290388
eap7-wildfly-http-ejb-client-1.1.17-1.Final_redhat_00002.1.el9eap.noarch.rpm SHA-256: 6b254bfa2272eb481d18b0f1db91b7134334568f22961f17b1bf3f9cc444b1ce
eap7-wildfly-http-naming-client-1.1.17-1.Final_redhat_00002.1.el9eap.noarch.rpm SHA-256: f57d4866099e51745f40b74e92d242d1ab5b90152dceda1ca622fd2b53afca9a
eap7-wildfly-http-transaction-client-1.1.17-1.Final_redhat_00002.1.el9eap.noarch.rpm SHA-256: b01db819835920e40ea912dcfa0a86a1d2adf1d27c32ddc5cb6652fa4ff1d37b
eap7-wildfly-java-jdk11-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 2df9c49560d81239d992236841fbea91005e5beea84a4c24c1c2a55418150196
eap7-wildfly-java-jdk17-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: b143b304e9a89b40b91854c5e704e4982847661c6233347ffd0863ed907f5f78
eap7-wildfly-java-jdk8-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 5dfec229c5fc2ceb2e46ed13ffcac497afc1310358f8da21c850920607bebf6d
eap7-wildfly-javadocs-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 4a5300fed4f05d301899e10c8f7fcaca46137f7360ec89bd7e20a4f1a1874e4a
eap7-wildfly-modules-7.4.17-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: e1267d5131abd81c34bafe39cd240d8a65aa3076bc07ffde1d25c6855809cbe8
eap7-wildfly-transaction-client-1.1.19-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: f3313fb377f103fc401f20a02eb9e86fc783842a8829b05e3e0e43136618b502
eap7-wss4j-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 67dfb1b24759fc958f7fe4f39aa9d8e81d00b303f7b80cacc0a6a4e0ae01f411
eap7-wss4j-bindings-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 244e12c6160da6932d368181453cecfb6f04e3e2d5bacfca948198e09ccee879
eap7-wss4j-policy-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 3970827aac40ed67cd365afec1f1b4631df3157a327bcc39f3e7582903878fad
eap7-wss4j-ws-security-common-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 90498454cf76d6cd1e44b711cc3f164d9eb3fa7dd7e2da11ce19763e3f4ecf01
eap7-wss4j-ws-security-dom-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 1bab5bb793b417d75c0ba45dc0a6877ac1a14a4bf7b50b51d3f497d7708787f7
eap7-wss4j-ws-security-policy-stax-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 74b84d1c7e1f88369dd5a50d5fccea8b7188383a98899c500f60e77e1a79ae05
eap7-wss4j-ws-security-stax-2.4.3-1.redhat_00001.1.el9eap.noarch.rpm SHA-256: 8fb5bcec7e703fec20d0c6a70409d4b71645f3095247cf0c7aea9d305f21e210
eap7-xml-security-2.3.4-1.redhat_00002.1.el9eap.noarch.rpm SHA-256: bf859453a8c059d2067380734994ab91e588e56914c85ab7f2cdb93d38f0b6dc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.