Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update

Fixed packages 81

Vulnerabilities 6

• High 8.1
  CVE-2020-28052 Public exploit

  Logic error in Legion of the Bouncy Castle BC Java

  An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…

  bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on org.bouncycastle:bcprov-jdk15 Debian Maven
  Dec 18, 2020
• High 7.5
  CVE-2020-35510

  Uncontrolled Resource Consumption in jboss-remoting

  A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client reque…

  org.jboss.remoting:jboss-remoting Maven
  Jun 2, 2021
• Medium 4.8
  CVE-2020-10687

  HTTP Request Smuggling in Undertow

  A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker …

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Sep 23, 2020
• Medium 4.8
  CVE-2021-20220

  HTTP request smuggling in Undertow

  A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker t…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Feb 23, 2021
• Medium 4.3
  CVE-2021-20250

  JBoss EJB Client information disclosure vulnerability

  A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

  org.jboss:jboss-ejb-client Maven
  May 13, 2021
• Low 3.3
  CVE-2020-8908

  Temp directory permission issue in Guava

  A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on un…

  Google Guava druid celeborn-0.6 Debian Ubuntu Azure Linux Wolfi Maven
  Dec 10, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1905796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1906919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1912881
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1923133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1929479
• article
  https://issues.redhat.com/browse/JBEAP-20336
• article
  https://issues.redhat.com/browse/JBEAP-20628
• article
  https://issues.redhat.com/browse/JBEAP-20672
• article
  https://issues.redhat.com/browse/JBEAP-20694
• article
  https://issues.redhat.com/browse/JBEAP-20695
• article
  https://issues.redhat.com/browse/JBEAP-20717
• article
  https://issues.redhat.com/browse/JBEAP-20762
• article
  https://issues.redhat.com/browse/JBEAP-20791
• article
  https://issues.redhat.com/browse/JBEAP-20795
• article
  https://issues.redhat.com/browse/JBEAP-20802
• article
  https://issues.redhat.com/browse/JBEAP-20805
• article
  https://issues.redhat.com/browse/JBEAP-20815
• article
  https://issues.redhat.com/browse/JBEAP-20816
• article
  https://issues.redhat.com/browse/JBEAP-20883
• article
  https://issues.redhat.com/browse/JBEAP-20887
• article
  https://issues.redhat.com/browse/JBEAP-20908
• article
  https://issues.redhat.com/browse/JBEAP-20918
• article
  https://issues.redhat.com/browse/JBEAP-20941
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0874.json
• report
  https://access.redhat.com/security/cve/CVE-2020-8908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8908
• report
  https://access.redhat.com/security/cve/CVE-2020-10687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1785049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10687
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10687
• report
  https://access.redhat.com/security/cve/CVE-2020-28052
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28052
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28052
• report
  https://access.redhat.com/security/cve/CVE-2020-35510
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-35510