Skip to content
OpenAdvisories
High RHSA-2021:3468 5 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8

Published Sep 13, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 65

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-apache-commons-io 0:2.10.0-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hal-console 0:3.2.16-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate 0:5.3.20-4.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-core 0:5.3.20-4.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-entitymanager 0:5.3.20-4.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-envers 0:5.3.20-4.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-hibernate-java8 0:5.3.20-4.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-api 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-impl 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-common-spi 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-core-api 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-core-impl 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-deployers-common 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-jdbc 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-ironjacamar-validator 0:1.4.35-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jakarta-el 0:3.0.3-2.redhat_00006.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jberet 0:1.3.9-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jberet-core 0:1.3.9-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-remoting 0:5.0.23-2.SP1_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-cli 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-core 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap6.4 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap6.4-to-eap7.3 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.0 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.1 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.2 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.2-to-eap7.3 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-eap7.3-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly10.0 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly10.1 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly11.0 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly12.0 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly13.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly14.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly15.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly16.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly17.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly18.0-server 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly8.2 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-jboss-server-migration-wildfly9.0 0:1.7.2-9.Final_redhat_00010.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-compensations 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-jbosstxbridge 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-jbossxts 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-jts-idlj 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-jts-integration 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-restat-api 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-restat-bridge 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-restat-integration 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-restat-util 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-narayana-txframework 0:5.9.12-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-picketbox 0:5.0.3-9.Final_redhat_00008.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-picketbox-infinispan 0:5.0.3-9.Final_redhat_00008.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-undertow 0:2.0.39-1.SP2_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly 0:7.3.9-2.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-client 0:1.0.29-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-client-common 0:1.0.29-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-ejb-client 0:1.0.29-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-naming-client 0:1.0.29-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-http-transaction-client 0:1.0.29-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-javadocs 0:7.3.9-2.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-modules 0:7.3.9-2.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 eap7-wildfly-transaction-client 0:1.1.14-2.Final_redhat_00001.1.el8eap

Vulnerabilities 5

  • High 7.5
    CVE-2021-3690

    Undertow vulnerable to memory exhaustion due to buffer leak

    A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2021-3597

    undertow Race Condition vulnerability

    A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28170

    Improper Input Validation in Jakarta Expression Language

    In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

    The Eclipse Foundation Jakarta Expression Language Implementation com.sun.el:el-ri org.glassfish:javax.el Debian Ubuntu Maven
  • Low 3.3
    CVE-2021-3644

    wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault

    A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should no…

    org.wildfly.core:wildfly-server Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1948752
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1965497
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1970930
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1976052
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1991299
  • article
    https://issues.redhat.com/browse/JBEAP-21466
  • article
    https://issues.redhat.com/browse/JBEAP-21468
  • article
    https://issues.redhat.com/browse/JBEAP-21958
  • article
    https://issues.redhat.com/browse/JBEAP-22003
  • article
    https://issues.redhat.com/browse/JBEAP-22029
  • article
    https://issues.redhat.com/browse/JBEAP-22079
  • article
    https://issues.redhat.com/browse/JBEAP-22085
  • article
    https://issues.redhat.com/browse/JBEAP-22138
  • article
    https://issues.redhat.com/browse/JBEAP-22159
  • article
    https://issues.redhat.com/browse/JBEAP-22195
  • article
    https://issues.redhat.com/browse/JBEAP-22198
  • article
    https://issues.redhat.com/browse/JBEAP-22200
  • article
    https://issues.redhat.com/browse/JBEAP-22204
  • article
    https://issues.redhat.com/browse/JBEAP-22227
  • article
    https://issues.redhat.com/browse/JBEAP-22317
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3468.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3597
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3597
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3597
  • report
    https://access.redhat.com/security/cve/CVE-2021-3644
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3644
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3644
  • report
    https://access.redhat.com/security/cve/CVE-2021-3690
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3690
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3690
  • report
    https://access.redhat.com/security/cve/CVE-2021-28170
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-28170
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-28170
  • article
    https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/
  • report
    https://access.redhat.com/security/cve/CVE-2021-29425
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-29425