Red Hat Product Errata RHSA-2024:7736 - Security Advisory
Issued:
2024-10-07
Updated:
2024-10-07

RHSA-2024:7736 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4 Security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.

This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.

Security Fix(es):

  • undertow: Improper State Management in Proxy Protocol parsing causes information leakage (CVE-2024-7885)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 9 x86_64
  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64

Fixes

  • BZ - 2305290 - CVE-2024-7885 undertow: Improper State Management in Proxy Protocol parsing causes information leakage

JBoss Enterprise Application Platform 7.4 for RHEL 9

SRPM
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el9eap.src.rpm SHA-256: b04cb663a24b1daee837728a56c05c261c0a8d2f56825e6147bafea33adcdc0d
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el9eap.src.rpm SHA-256: e369529b83cd11281bf47f41b91324aebb04a4219e58deefab8cc45ae88cdcd3
x86_64
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el9eap.noarch.rpm SHA-256: 22a8d6256e6bd9fcf7b71241071014fb8b7f4a7d937fa8927bd5100a75a18146
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 1e4d1383d45f9c495eb52290603b8d75b5f287c5d86a36bfad4ca82757df91b0
eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 5873aaaedee26f0ccf6c88a63b779ba0ceed1c28b9734ff6ea1b196a394a3bb9
eap7-wildfly-java-jdk17-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 33c0e5fe162c4d7be5607858e36a659206ab4d8b2269ceca816c72ce9a4ec589
eap7-wildfly-java-jdk8-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: a0e0958a40ba4d3e72eb110e44130c8db2f0a1e6eef8003e24e0f8defa9b890b
eap7-wildfly-javadocs-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 8bd1ce66edad9070a39fcde57b83def1e085cc22cb9f7fd457eff9cf0844e35e
eap7-wildfly-modules-7.4.18-1.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: dc65ed48f54fe60d3221d50e485d8ffea3ec1e42db9fb26f301ec4a98f1b5145

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el8eap.src.rpm SHA-256: 7a78c037bf375c1bd708a53c6254fef835fe990507139d7b9860683bc5a094f2
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el8eap.src.rpm SHA-256: 3bad60a10130775fd24ea250337115330e502a6d3a769d513eef7190643cc11a
x86_64
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el8eap.noarch.rpm SHA-256: 4d54998db0dfe9248430d6d6095e00a04a325161da24e7ccea57bdb91a01f7ad
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 6262893ef89b29f8ab10d94c5c91b2300ba73fdaae93760195631cb31644d183
eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 05d2a2505bab5834f94c1ef9b60df44ec1ede8c64064c283217f51e63bee3711
eap7-wildfly-java-jdk17-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 4d86cad99fc1f04264507126407b8952388e28efa5ce3156284fc0b3dd7d9e22
eap7-wildfly-java-jdk8-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 8e52c00ddd78522385e21fe5e57ac0ad946bf56f3ef1d750ee528da0ca9651bd
eap7-wildfly-javadocs-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: ccb815e41be49277b93e2d562e44e28374a2e7168b5bc2fd9c538b1dc7f8e2b3
eap7-wildfly-modules-7.4.18-1.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 3c6123f0ef061073847a876ff27bfcfbeb21121282f668a3669c394546a26625

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el7eap.src.rpm SHA-256: 8bc64b1fcd6cf1a5bd608c771c17375cc16c6ee1ad46ad499fb0aac4902aea4c
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el7eap.src.rpm SHA-256: e92a616a4557a5b4b7a5e92a72b4ab9848f912aa462a7f210f09af54e0f195b1
x86_64
eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el7eap.noarch.rpm SHA-256: cae2cc21aa0257bd08a9b21e53a5aea98dace5aa23e168295df80c5b55031c5e
eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 72754a3f6d2402520e360bb6183658a378e18be7ea10c711ed120df4db3c47d9
eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 4f351cc849c3dee3935ac3ab14fa9cf78565a719646dd863c4c07838f0065769
eap7-wildfly-java-jdk8-7.4.18-1.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: fa03f235ea5829acb940aecc660a5e3975ebb9471524264f4ee91193fc20f9b6
eap7-wildfly-javadocs-7.4.18-1.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: e8db21b64499001432b64789d639e43a904290f112e559527bbc2fa88c2a8b7c
eap7-wildfly-modules-7.4.18-1.GA_redhat_00003.1.el7eap.noarch.rpm SHA-256: 3e5d4b88d85b66541633054e23003c5edc1846be3cd2f83f867e284e3cc4ad1d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.