Skip to content
OpenAdvisories
High RHSA-2021:0247 6 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.5 security update

Published Oct 1, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 98

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-cli 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-commons 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-core-client 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-dto 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-hornetq-protocol 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-hqclient-protocol 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jdbc-store 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jms-client 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jms-server 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-journal 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-ra 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-selector 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-server 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-service-extensions 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-tools 0:2.9.0-7.redhat_00017.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-glassfish-jsf 0:2.3.9-12.SP13_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hal-console 0:3.2.12-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hibernate 0:5.3.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hibernate-core 0:5.3.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hibernate-entitymanager 0:5.3.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hibernate-envers 0:5.3.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hibernate-java8 0:5.3.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-httpcomponents-client 0:4.5.13-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-ejb-client 0:4.0.37-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-genericjms 0:2.0.8-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-modules 0:1.11.0-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-remoting 0:5.0.20-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-cli 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-core 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap6.4 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap6.4-to-eap7.3 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.0 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.1 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.2 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.2-to-eap7.3 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.3-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly10.0 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly10.1 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly11.0 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly12.0 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly13.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly14.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly15.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly16.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly17.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly18.0-server 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly8.2 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly9.0 0:1.7.2-4.Final_redhat_00005.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-xnio-base 0:3.7.12-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-compensations 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jbosstxbridge 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jbossxts 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jts-idlj 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jts-integration 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-api 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-bridge 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-integration 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-util 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-txframework 0:5.9.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-opentracing-interceptors 0:0.0.4.1-2.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-atom-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-cdi 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-client 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-client-microprofile 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-crypto 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jackson-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jackson2-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jaxb-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jaxrs 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jettison-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jose-jwt 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-jsapi 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-json-binding-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-json-p-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-multipart-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-rxjava2 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-spring 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-validator-provider-11 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-resteasy-yaml-provider 0:3.11.3-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-undertow 0:2.0.33-1.SP2_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly 0:7.3.5-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-discovery 0:1.2.1-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-discovery-client 0:1.2.1-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-elytron 0:1.10.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-elytron-tool 0:1.10.10-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-client 0:1.0.24-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-client-common 0:1.0.24-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-ejb-client 0:1.0.24-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-naming-client 0:1.0.24-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-transaction-client 0:1.0.24-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-java-jdk11 0:7.3.5-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-java-jdk8 0:7.3.5-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-javadocs 0:7.3.5-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-modules 0:7.3.5-2.GA_redhat_00001.1.el7eap

Vulnerabilities 6

  • High 7.5
    CVE-2020-27782

    Denial of service in Undertow

    A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerabilit…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 5.9
    CVE-2020-27822

    Wildfly has a memory leak vulnerability

    A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to…

    org.wildfly:wildfly-parent Maven
  • Medium 5.3
    CVE-2020-13956

    Cross-site scripting in Apache HttpClient

    Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

    druid trino trino-plugin-opensearch trino-plugin-pinot Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2020-25633

    Generation of Error Message Containing Sensitive Information in RESTEasy client

    A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat…

    Red Hat resteasy-client resteasy resteasy3.0 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2020-25640

    Wildfly logs plaintext passwords

    A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

    org.wildfly:wildfly-parent Maven
  • Medium 5.3
    CVE-2020-25689

    Uncontrolled Resource Consumption in WildFly

    A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attack…

    Red Hat wildfly-core org.wildfly:wildfly-dist Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1879042
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1881637
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1886587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1893070
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1901304
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1904060
  • article
    https://issues.redhat.com/browse/JBEAP-19788
  • article
    https://issues.redhat.com/browse/JBEAP-19790
  • article
    https://issues.redhat.com/browse/JBEAP-19816
  • article
    https://issues.redhat.com/browse/JBEAP-20240
  • article
    https://issues.redhat.com/browse/JBEAP-20268
  • article
    https://issues.redhat.com/browse/JBEAP-20270
  • article
    https://issues.redhat.com/browse/JBEAP-20286
  • article
    https://issues.redhat.com/browse/JBEAP-20288
  • article
    https://issues.redhat.com/browse/JBEAP-20333
  • article
    https://issues.redhat.com/browse/JBEAP-20373
  • article
    https://issues.redhat.com/browse/JBEAP-20376
  • article
    https://issues.redhat.com/browse/JBEAP-20399
  • article
    https://issues.redhat.com/browse/JBEAP-20403
  • article
    https://issues.redhat.com/browse/JBEAP-20405
  • article
    https://issues.redhat.com/browse/JBEAP-20438
  • article
    https://issues.redhat.com/browse/JBEAP-20480
  • article
    https://issues.redhat.com/browse/JBEAP-20502
  • article
    https://issues.redhat.com/browse/JBEAP-20521
  • article
    https://issues.redhat.com/browse/JBEAP-20591
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0247.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-13956
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-13956
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-13956
  • article
    https://www.openwall.com/lists/oss-security/2020/10/08/4
  • report
    https://access.redhat.com/security/cve/CVE-2020-25633
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-25633
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-25633
  • report
    https://access.redhat.com/security/cve/CVE-2020-25640
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-25640
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-25640