Skip to content
OpenAdvisories
High RHSA-2021:0873 6 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update

Published Sep 13, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 83

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-cli 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-commons 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-core-client 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-dto 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-hornetq-protocol 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-hqclient-protocol 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jdbc-store 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jms-client 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-jms-server 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-journal 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-ra 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-selector 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-server 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-service-extensions 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-activemq-artemis-tools 0:2.9.0-9.redhat_00019.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-bouncycastle 0:1.68.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-bouncycastle-mail 0:1.68.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-bouncycastle-pkix 0:1.68.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-bouncycastle-prov 0:1.68.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-guava 0:30.1.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-guava-failureaccess 0:1.0.1-1.redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-guava-libraries 0:30.1.0-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-hal-console 0:3.2.13-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-common-api 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-common-impl 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-common-spi 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-core-api 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-core-impl 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-deployers-common 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-jdbc 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-ironjacamar-validator 0:1.4.27-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-ejb-client 0:4.0.39-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-logmanager 0:2.1.18-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-remoting 0:5.0.20-2.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-cli 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-core 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap6.4 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap6.4-to-eap7.3 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.0 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.1 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.2 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.2-to-eap7.3 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-eap7.3-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly10.0 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly10.1 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly11.0 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly12.0 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly13.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly14.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly15.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly16.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly17.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly18.0-server 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly8.2 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-jboss-server-migration-wildfly9.0 0:1.7.2-5.Final_redhat_00006.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-compensations 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jbosstxbridge 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jbossxts 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jts-idlj 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-jts-integration 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-api 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-bridge 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-integration 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-restat-util 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-narayana-txframework 0:5.9.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-undertow 0:2.0.34-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly 0:7.3.6-1.GA_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-elytron 0:1.10.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-elytron-tool 0:1.10.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-client 0:1.0.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-client-common 0:1.0.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-ejb-client 0:1.0.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-naming-client 0:1.0.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-http-transaction-client 0:1.0.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-java-jdk11 0:7.3.6-1.GA_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-java-jdk8 0:7.3.6-1.GA_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-javadocs 0:7.3.6-1.GA_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-modules 0:7.3.6-1.GA_redhat_00002.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 eap7-wildfly-naming-client 0:1.0.14-1.Final_redhat_00001.1.el7eap

Vulnerabilities 6

  • High 8.1
    CVE-2020-28052 Public exploit

    Logic error in Legion of the Bouncy Castle BC Java

    An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…

    bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on org.bouncycastle:bcprov-jdk15 Debian Maven
  • High 7.5
    CVE-2020-35510

    Uncontrolled Resource Consumption in jboss-remoting

    A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client reque…

    org.jboss.remoting:jboss-remoting Maven
  • Medium 4.8
    CVE-2020-10687

    HTTP Request Smuggling in Undertow

    A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker …

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 4.8
    CVE-2021-20220

    HTTP request smuggling in Undertow

    A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker t…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 4.3
    CVE-2021-20250

    JBoss EJB Client information disclosure vulnerability

    A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

    org.jboss:jboss-ejb-client Maven
  • Low 3.3
    CVE-2020-8908

    Temp directory permission issue in Guava

    A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on un…

    Google Guava druid celeborn-0.6 Debian Ubuntu Azure Linux Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1905796
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1906919
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912881
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1923133
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1929479
  • article
    https://issues.redhat.com/browse/JBEAP-20336
  • article
    https://issues.redhat.com/browse/JBEAP-20628
  • article
    https://issues.redhat.com/browse/JBEAP-20672
  • article
    https://issues.redhat.com/browse/JBEAP-20694
  • article
    https://issues.redhat.com/browse/JBEAP-20695
  • article
    https://issues.redhat.com/browse/JBEAP-20716
  • article
    https://issues.redhat.com/browse/JBEAP-20762
  • article
    https://issues.redhat.com/browse/JBEAP-20791
  • article
    https://issues.redhat.com/browse/JBEAP-20795
  • article
    https://issues.redhat.com/browse/JBEAP-20802
  • article
    https://issues.redhat.com/browse/JBEAP-20805
  • article
    https://issues.redhat.com/browse/JBEAP-20815
  • article
    https://issues.redhat.com/browse/JBEAP-20816
  • article
    https://issues.redhat.com/browse/JBEAP-20883
  • article
    https://issues.redhat.com/browse/JBEAP-20887
  • article
    https://issues.redhat.com/browse/JBEAP-20908
  • article
    https://issues.redhat.com/browse/JBEAP-20918
  • article
    https://issues.redhat.com/browse/JBEAP-20941
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0873.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-8908
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8908
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8908
  • report
    https://access.redhat.com/security/cve/CVE-2020-10687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1785049
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10687
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10687
  • report
    https://access.redhat.com/security/cve/CVE-2020-28052
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-28052
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-28052
  • report
    https://access.redhat.com/security/cve/CVE-2020-35510
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-35510