Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update

Fixed packages 200

Vulnerabilities 21

• Critical 9.8
  CVE-2020-8840 Public exploit EPSS 27%

  Deserialization of Untrusted Data in jackson-databind

  FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Feb 10, 2020
• Critical 9.8
  CVE-2020-9546

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9547 Public exploit Scanner template EPSS 18%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9548 Public exploit Scanner template EPSS 19%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• High 8.6
  CVE-2020-1745

  Improper Authorization in Undertoe

  A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability …

  undertow-io undertow undertow undertow Debian Ubuntu Maven
  Apr 28, 2020
• High 8.1
  CVE-2020-1757

  Improper Input Validation in Undertow

  A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path afte…

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Apr 21, 2020
• High 7.5
  CVE-2018-14371

  Path Traversal in Eclipse Mojarra

  The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

  org.glassfish:mojarra-parent mojarra Ubuntu Maven
  Jul 18, 2018
• High 7.5
  CVE-2019-0205 Public exploit

  Loop with Unreachable Exit Condition in Apache Thrift

  In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects o…

  Apache Apache Thrift druid trino Debian Azure Linux Wolfi Maven
  Oct 28, 2019
• High 7.5
  CVE-2019-0210

  Out-of-bounds read in Apache Thrift

  In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

  Apache Apache Thrift thrift github.com/apache/thrift Debian Go
  Oct 28, 2019
• High 7.5
  CVE-2019-12423

  Private key leak in Apache CXF

  Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local …

  Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  Jan 16, 2020
• High 7.5
  CVE-2020-10705

  Allocation of Resources Without Limits or Throttling in Undertow

  A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Jun 10, 2020
• High 7.5
  CVE-2020-1695

  Improper Input Validation in RESTEasy

  A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may res…

  Red Hat RESTEasy resteasy resteasy3.0 Debian Ubuntu Maven
  May 19, 2020
• High 7.5
  CVE-2020-6950 Public exploit Scanner template EPSS 10%

  Directory traversal in Eclipse Mojarra

  Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

  org.glassfish:mojarra-parent Maven
  Jun 2, 2021
• High 7.5
  CVE-2020-7226

  Denial of Service in Cryptacular

  CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input wi…

  org.cryptacular:cryptacular Maven
  Jan 24, 2020
• High 7.4
  CVE-2019-14887

  A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly c…

  Red Hat wildfly
  Mar 16, 2020
• Medium 6.5
  CVE-2020-10719

  HTTP Request Smuggling in Undertow

  A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  May 26, 2020
• Medium 6.1
  CVE-2019-17573 Public exploit

  Reflected Cross-Site Scripting in Apache CXF

  By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…

  Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  Jan 16, 2020
• Medium 5.9
  CVE-2019-10172 Public exploit EPSS 17%

  Improper Restriction of XML External Entity Reference in jackson-mapper-asl

  A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

  Red Hat jackson-mapper-asl tez spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 18, 2019
• Medium 5.4
  CVE-2020-10688

  Cross-site scripting in RESTEasy

  A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS a…

  resteasy resteasy3.0 resteasy3.0 org.jboss.resteasy:resteasy-bom Debian Ubuntu Maven
  May 27, 2021
• Medium 5.4
  CVE-2020-1719

  Privilege Context Switching Error in wildlfy

  A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final ar…

  org.wildfly.bom:wildfly Maven
  Jun 7, 2021
• Medium 4.0
  CVE-2020-1729

  Permissions bypass in SmallRye

  A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vu…

  io.smallrye.config:smallrye-config Maven
  May 28, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1607709
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1715075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1730462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752770
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764607
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772008
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797011
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1801380
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1802444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1805006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1807305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1814974
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1828459
• article
  https://issues.redhat.com/browse/JBEAP-16114
• article
  https://issues.redhat.com/browse/JBEAP-18060
• article
  https://issues.redhat.com/browse/JBEAP-18163
• article
  https://issues.redhat.com/browse/JBEAP-18221
• article
  https://issues.redhat.com/browse/JBEAP-18240
• article
  https://issues.redhat.com/browse/JBEAP-18241
• article
  https://issues.redhat.com/browse/JBEAP-18273
• article
  https://issues.redhat.com/browse/JBEAP-18277
• article
  https://issues.redhat.com/browse/JBEAP-18288
• article
  https://issues.redhat.com/browse/JBEAP-18294
• article
  https://issues.redhat.com/browse/JBEAP-18302
• article
  https://issues.redhat.com/browse/JBEAP-18315
• article
  https://issues.redhat.com/browse/JBEAP-18346
• article
  https://issues.redhat.com/browse/JBEAP-18352
• article
  https://issues.redhat.com/browse/JBEAP-18361
• article
  https://issues.redhat.com/browse/JBEAP-18367
• article
  https://issues.redhat.com/browse/JBEAP-18393