Red Hat Product Errata RHSA-2024:7441 - Security Advisory
Issued:
2024-10-01
Updated:
2024-10-01

RHSA-2024:7441 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 8.0 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime.

This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 8.0.

Security Fix(es):

  • software.amazon.ion/ion-java: ion-java: Ion Java StackOverflow vulnerability (CVE-2024-21634)
  • undertow: Improper State Management in Proxy Protocol parsing causes information leakage (CVE-2024-7885)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 8.0 for RHEL 9 x86_64
  • JBoss Enterprise Application Platform 8.0 for RHEL 8 x86_64

Fixes

  • BZ - 2304311 - CVE-2024-21634 ion-java: ion-java: Ion Java StackOverflow vulnerability
  • BZ - 2305290 - CVE-2024-7885 undertow: Improper State Management in Proxy Protocol parsing causes information leakage
  • JBEAP-27711 - (8.0.z) Upgrade amazon-ion from 1.0.2.redhat-00004 to 1.11.9.redhat-00001
  • JBEAP-27754 - (8.0.z) Upgrade EAP codebase to 8.0.5.SP1-redhat-SNAPSHOT in EAP 8.0 update 3.1

JBoss Enterprise Application Platform 8.0 for RHEL 9

SRPM
eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el9eap.src.rpm SHA-256: f450431d0d32dcdefcad682597ee33a329a02e888cb30a4b4d712c01bf95878a
eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el9eap.src.rpm SHA-256: bebbe60e11f34b2222e693667e03650a682d13c2c195accb3636071a1cffe1ac
eap8-undertow-2.3.14-2.SP2_redhat_00001.1.el9eap.src.rpm SHA-256: 87d9ffbccef1901f7dab55b1dcd2a8c8bbb4575c2fd9f67d9fd2f8350063eadb
eap8-wildfly-8.0.3-13.GA_redhat_00007.1.el9eap.src.rpm SHA-256: 32c08c54c5d84b1028a479ebc827ec238c11fc43fc2febcd45358c29de085188
x86_64
eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el9eap.noarch.rpm SHA-256: c580719a7c5ee13bc3f9e51c3e4528eebe30c3a750a0547ae81f112870243967
eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 36b81afb47d0e754f6b5edba260aecc2ca04872c24487abcd1d0f3891f676efd
eap8-eap-product-conf-wildfly-ee-feature-pack-800.3.1-2.GA_redhat_00002.1.el9eap.noarch.rpm SHA-256: 56b500b8a66c411fdacf2ba05de3bc52c156e56cc434d6db75eab088f40af1af
eap8-undertow-2.3.14-2.SP2_redhat_00001.1.el9eap.noarch.rpm SHA-256: 47633e0f33b26738507a03359d5ec147f8f455d5dd3d5370bb7c076ad10e1f4e
eap8-wildfly-8.0.3-13.GA_redhat_00007.1.el9eap.noarch.rpm SHA-256: 79b81eee1c2cea59dcf334f3c11788627b99cc2e70b92ce11613526db0a16fb3
eap8-wildfly-java-jdk11-8.0.3-13.GA_redhat_00007.1.el9eap.noarch.rpm SHA-256: 8d9abe78ec434a6b0356508827235ea13d6d55e739832dc5a7e64568973fc080
eap8-wildfly-java-jdk17-8.0.3-13.GA_redhat_00007.1.el9eap.noarch.rpm SHA-256: 8dc6e50a8f9c8bc5e47ac5276fa485c5c71bd648ac10ab91d39bf384eec5c513
eap8-wildfly-java-jdk21-8.0.3-13.GA_redhat_00007.1.el9eap.noarch.rpm SHA-256: 4698d20a56fe7830130a3c15a41395071c48ed80ec4eeece1c9d3734ca8a86a5
eap8-wildfly-modules-8.0.3-13.GA_redhat_00007.1.el9eap.noarch.rpm SHA-256: d1e7c4cfda8ef0f39f7a54eaae0f45a62ece640a4dc0cee587d568f7f31c3bfb

JBoss Enterprise Application Platform 8.0 for RHEL 8

SRPM
eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el8eap.src.rpm SHA-256: 528fba6eb0fc8e0c2c139c4a69a6176dd367820d626f8c10ae882940691b46fc
eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el8eap.src.rpm SHA-256: d87cb3e7839ed596edcdb8e070c24b539eb6f16030e26fe5c5ea65da61ac7880
eap8-undertow-2.3.14-2.SP2_redhat_00001.1.el8eap.src.rpm SHA-256: 551b51b7d7fb58e2cdcac4f9a26ed8f47d299448ecf7ee0c85ea9647692512a3
eap8-wildfly-8.0.3-13.GA_redhat_00007.1.el8eap.src.rpm SHA-256: 9c7bc6f1d91ddf49e6da6e8fc9eaf1308417fce3f4ae49edf29735c12a7320c9
x86_64
eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el8eap.noarch.rpm SHA-256: c5d05251578a9f44f90e880a2ba9573ec58229d88563d9db12bb5ee2a5bec769
eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 3a161bd130a20b8bc7ea5210bd72df1482ef2473f357a4fc9a4d3d1dbd1736a3
eap8-eap-product-conf-wildfly-ee-feature-pack-800.3.1-2.GA_redhat_00002.1.el8eap.noarch.rpm SHA-256: 2063cc38cdf3bd117fa5ba2b062eaa6380dc5c81ce372581dc8ccd7c6456eab7
eap8-undertow-2.3.14-2.SP2_redhat_00001.1.el8eap.noarch.rpm SHA-256: c75c5848b536e7c1311aca538d9b13713186df56bda3d248f759ef56ea1cf6ad
eap8-wildfly-8.0.3-13.GA_redhat_00007.1.el8eap.noarch.rpm SHA-256: 3817b9248e374caa7043b2e76c89f88bd784ab61b47339b00ed362165d338f78
eap8-wildfly-java-jdk11-8.0.3-13.GA_redhat_00007.1.el8eap.noarch.rpm SHA-256: 7a60fe864792973d68ea05c4ed817554d0cd584da07ea0e14aa09dc11e4715b4
eap8-wildfly-java-jdk17-8.0.3-13.GA_redhat_00007.1.el8eap.noarch.rpm SHA-256: 9795d6d54ed596a829b067f5c7d4e8d7d8b9b4b9254d1c28e8db13c64c23444a
eap8-wildfly-java-jdk21-8.0.3-13.GA_redhat_00007.1.el8eap.noarch.rpm SHA-256: 0bfa4150d20bbe7ce18afc0a33b2f015889e37c49af3aefe423fac5565e60f64
eap8-wildfly-modules-8.0.3-13.GA_redhat_00007.1.el8eap.noarch.rpm SHA-256: a02be4cd49dacf38e048c89c120682e8ddb1c2667bbbf7373f22752695b734dd

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.