Skip to content
OpenAdvisories
High RHSA-2020:0962 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 27

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-jaegertracing-jaeger-client-java 0:0.34.1-1.redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-jaegertracing-jaeger-client-java-core 0:0.34.1-1.redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-jaegertracing-jaeger-client-java-thrift 0:0.34.1-1.redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-thrift 0:0.13.0-1.redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-undertow 0:2.0.28-4.SP1_redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-wildfly-openssl 0:1.0.9-2.SP03_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-wildfly-openssl-java 0:1.0.9-2.SP03_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-wildfly-openssl-linux-x86_64 0:1.0.9-2.SP03_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 eap7-wildfly-openssl-linux-x86_64-debuginfo 0:1.0.9-2.SP03_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jaegertracing-jaeger-client-java 0:0.34.1-1.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jaegertracing-jaeger-client-java-core 0:0.34.1-1.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jaegertracing-jaeger-client-java-thrift 0:0.34.1-1.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-thrift 0:0.13.0-1.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-undertow 0:2.0.28-4.SP1_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-openssl 0:1.0.9-2.SP03_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-openssl-java 0:1.0.9-2.SP03_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-openssl-linux-x86_64 0:1.0.9-2.SP03_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-openssl-linux-x86_64-debuginfo 0:1.0.9-2.SP03_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jaegertracing-jaeger-client-java 0:0.34.1-1.redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jaegertracing-jaeger-client-java-core 0:0.34.1-1.redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jaegertracing-jaeger-client-java-thrift 0:0.34.1-1.redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-thrift 0:0.13.0-1.redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-undertow 0:2.0.28-4.SP1_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-openssl 0:1.0.9-2.SP03_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-openssl-java 0:1.0.9-2.SP03_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-openssl-linux-x86_64 0:1.0.9-2.SP03_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-openssl-linux-x86_64-debuginfo 0:1.0.9-2.SP03_redhat_00001.1.el8eap

Vulnerabilities 4

  • High 8.6
    CVE-2020-1745

    Improper Authorization in Undertoe

    A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability …

    undertow-io undertow undertow undertow Debian Ubuntu Maven
  • High 7.5
    CVE-2019-0205 Public exploit

    Loop with Unreachable Exit Condition in Apache Thrift

    In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects o…

    Apache Apache Thrift druid trino Debian Azure Linux Wolfi Maven
  • High 7.5
    CVE-2019-0210

    Out-of-bounds read in Apache Thrift

    In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

    Apache Apache Thrift thrift github.com/apache/thrift Debian Go
  • High 7.4
    CVE-2019-14887

    A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly c…

    Red Hat wildfly

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1764607
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1764612
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1772008
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1807305
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0962.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-0205
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-0205
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-0205
  • report
    https://access.redhat.com/security/cve/CVE-2019-0210
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-0210
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-0210
  • report
    https://access.redhat.com/security/cve/CVE-2019-14887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14887
  • report
    https://access.redhat.com/security/cve/CVE-2020-1745
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1745
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1745
  • article
    https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/
  • article
    https://www.cnvd.org.cn/webinfo/show/5415
  • article
    https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487