Skip to content
OpenAdvisories
Critical RHSA-2020:3463 14 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update

Published Sep 16, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 81

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-dom4j 0:2.1.3-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-elytron-web 0:1.6.2-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-glassfish-jsf 0:2.3.9-11.SP11_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hal-console 0:3.2.9-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate 0:5.3.17-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-core 0:5.3.17-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-entitymanager 0:5.3.17-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-envers 0:5.3.17-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-java8 0:5.3.17-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-validator 0:6.0.20-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-validator-cdi 0:6.0.20-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-cachestore-jdbc 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-cachestore-remote 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-client-hotrod 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-commons 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-core 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-hibernate-cache-commons 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-hibernate-cache-spi 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-infinispan-hibernate-cache-v53 0:9.4.19-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-api 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-impl 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-spi 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-core-api 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-core-impl 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-deployers-common 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-jdbc 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-validator 0:1.4.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-annotations 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-core 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-databind 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-datatype-jdk8 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-datatype-jsr310 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-jaxrs-base 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-jaxrs-json-provider 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-jaxrs-providers 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-module-jaxb-annotations 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-modules-base 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jackson-modules-java8 0:2.10.4-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-genericjms 0:2.0.6-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-jsf-api_2.3_spec 0:3.0.0-4.SP04_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-logmanager 0:2.1.15-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-cli 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-core 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap6.4 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap6.4-to-eap7.3 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.0 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.1 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.2 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.2-to-eap7.3 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.3-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly10.0 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly10.1 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly11.0 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly12.0 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly13.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly14.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly15.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly16.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly17.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly18.0-server 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly8.2 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly9.0 0:1.7.1-7.Final_redhat_00009.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-xnio-base 0:3.7.8-1.SP1_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-netty 0:4.1.48-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-netty-all 0:4.1.48-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-undertow 0:2.0.30-4.SP4_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-undertow-server 0:1.6.2-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly 0:7.3.2-4.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-common 0:1.5.2-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-elytron 0:1.10.7-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-elytron-tool 0:1.10.7-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-client 0:1.0.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-client-common 0:1.0.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-ejb-client 0:1.0.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-naming-client 0:1.0.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-transaction-client 0:1.0.22-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-javadocs 0:7.3.2-4.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-modules 0:7.3.2-4.GA_redhat_00002.1.el8eap

Vulnerabilities 14

  • Critical 9.8
    CVE-2020-10683

    dom4j allows External Entities by default which might enable XXE attacks

    dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any applicatio…

    dom4j org.dom4j:dom4j dom4j:dom4j dom4j Debian Ubuntu Maven
  • High 8.8
    CVE-2020-10672

    jackson-databind mishandles the interaction between serialization gadgets and typing

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 8.8
    CVE-2020-10673 Public exploit

    jackson-databind mishandles the interaction between serialization gadgets and typing

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 7.5
    CVE-2020-10714

    Session Fixation in WildFly Elytron

    A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confid…

    org.wildfly.security:wildfly-elytron Maven
  • High 7.5
    CVE-2020-11612

    Denial of Service in Netty

    The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to …

    netty netty io.netty:netty-handler Debian Ubuntu Maven
  • High 7.5
    CVE-2020-1748

    Incorrect Authorization in WildFly Elytron

    A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information expos…

    org.wildfly.security:wildfly-elytron Maven
  • Medium 6.6
    CVE-2020-10740

    Wildfly Unsafe Deserialization Vulnerability

    A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

    [UNKNOWN] wildfly org.wildfly:wildfly-parent Maven
  • Medium 6.5
    CVE-2019-14900 Public exploit

    SQL Injection in Hibernate ORM

    A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw c…

    org.hibernate:hibernate-core fuse Azure Linux Maven
  • Medium 6.5
    CVE-2020-14297

    Wildfly EJB Client causes DoS

    A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and…

    Red Hat wildfly org.jboss:jboss-ejb-client Maven
  • Medium 6.5
    CVE-2020-14307

    A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where Ses…

    Red Hat wildfly
  • Medium 5.3
    CVE-2020-10693

    Improper Input Validation in Hibernate Validator

    A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) control…

    Hibernate hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Ubuntu Maven
  • Medium 4.8
    CVE-2020-10687

    HTTP Request Smuggling in Undertow

    A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker …

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Unscored —
    CVE-2020-10718

    A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed…

  • Unscored —
    CVE-2020-1710

    The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1666499
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1694235
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1785049
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793970
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1805501
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1807707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1815470
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1815495
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1825714
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1828476
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1834512
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1853595
  • article
    https://issues.redhat.com/browse/JBEAP-19095
  • article
    https://issues.redhat.com/browse/JBEAP-19134
  • article
    https://issues.redhat.com/browse/JBEAP-19185
  • article
    https://issues.redhat.com/browse/JBEAP-19203
  • article
    https://issues.redhat.com/browse/JBEAP-19269
  • article
    https://issues.redhat.com/browse/JBEAP-19322
  • article
    https://issues.redhat.com/browse/JBEAP-19325
  • article
    https://issues.redhat.com/browse/JBEAP-19397
  • article
    https://issues.redhat.com/browse/JBEAP-19410
  • article
    https://issues.redhat.com/browse/JBEAP-19411
  • article
    https://issues.redhat.com/browse/JBEAP-19529
  • article
    https://issues.redhat.com/browse/JBEAP-19564
  • article
    https://issues.redhat.com/browse/JBEAP-19585
  • article
    https://issues.redhat.com/browse/JBEAP-19617
  • article
    https://issues.redhat.com/browse/JBEAP-19619
  • article
    https://issues.redhat.com/browse/JBEAP-19673
  • article
    https://issues.redhat.com/browse/JBEAP-19674
  • article
    https://issues.redhat.com/browse/JBEAP-19874
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3463.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-14900
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14900
  • report
    https://access.redhat.com/security/cve/CVE-2020-1710
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1710