Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update

Fixed packages 67

Vulnerabilities 3

• High 7.5
  CVE-2020-25644

  Wildfly-OpenSSL memory leak flaw

  A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

  org.wildfly.openssl:wildfly-openssl-natives-parent Maven
  Oct 6, 2020
• High 7.5
  CVE-2020-25649 EPSS 18%

  XML External Entity (XXE) Injection in Jackson Databind

  A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Dec 3, 2020
• High 7.4
  CVE-2020-25638

  SQL injection in hibernate-core

  A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an…

  org.hibernate:hibernate-core libhibernate3-java libhibernate3-java Debian Ubuntu Maven
  Dec 2, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1885485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1887664
• article
  https://issues.redhat.com/browse/JBEAP-20029
• article
  https://issues.redhat.com/browse/JBEAP-20089
• article
  https://issues.redhat.com/browse/JBEAP-20119
• article
  https://issues.redhat.com/browse/JBEAP-20161
• article
  https://issues.redhat.com/browse/JBEAP-20221
• article
  https://issues.redhat.com/browse/JBEAP-20239
• article
  https://issues.redhat.com/browse/JBEAP-20246
• article
  https://issues.redhat.com/browse/JBEAP-20285
• article
  https://issues.redhat.com/browse/JBEAP-20300
• article
  https://issues.redhat.com/browse/JBEAP-20325
• article
  https://issues.redhat.com/browse/JBEAP-20364
• article
  https://issues.redhat.com/browse/JBEAP-20368
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5340.json
• report
  https://access.redhat.com/security/cve/CVE-2020-25638
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25638
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25638
• report
  https://access.redhat.com/security/cve/CVE-2020-25644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25644
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25644
• report
  https://access.redhat.com/security/cve/CVE-2020-25649
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25649
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25649
• article
  https://github.com/FasterXML/jackson-databind/issues/2589