Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7

Fixed packages 27

Vulnerabilities 5

• High 7.8
  CVE-2021-3717

  Wildfly-Core user account mismanagement

  A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…

  org.wildfly.core:wildfly-core-parent Maven
  May 24, 2022
• High 7.5
  CVE-2021-30129

  DoS/OOM leak vulnerability in Apache Mina SSHD Server

  A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache …

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-core org.apache.sshd:sshd-mina Maven
  Jul 12, 2021
• High 7.5
  CVE-2021-3629

  Undertow Uncontrolled Resource Consumption

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Und…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  May 24, 2022
• High 7.5
  CVE-2021-37714

  Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

  jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to ge…

  jhy jsoup org.jsoup:jsoup jsoup Debian Ubuntu Azure Linux Maven
  Aug 18, 2021
• Medium 5.3
  CVE-2021-20289

  Exposure of class information in RESTEasy

  A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…

  resteasy resteasy3.0 org.jboss.resteasy:resteasy-core Ubuntu Maven
  Mar 26, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1935927
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1977362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995259
• article
  https://issues.redhat.com/browse/JBEAP-21308
• article
  https://issues.redhat.com/browse/JBEAP-21973
• article
  https://issues.redhat.com/browse/JBEAP-22208
• article
  https://issues.redhat.com/browse/JBEAP-22213
• article
  https://issues.redhat.com/browse/JBEAP-22254
• article
  https://issues.redhat.com/browse/JBEAP-22255
• article
  https://issues.redhat.com/browse/JBEAP-22344
• article
  https://issues.redhat.com/browse/JBEAP-22347
• article
  https://issues.redhat.com/browse/JBEAP-22365
• article
  https://issues.redhat.com/browse/JBEAP-22367
• article
  https://issues.redhat.com/browse/JBEAP-22435
• article
  https://issues.redhat.com/browse/JBEAP-22462
• article
  https://issues.redhat.com/browse/JBEAP-22487
• article
  https://issues.redhat.com/browse/JBEAP-22493
• article
  https://issues.redhat.com/browse/JBEAP-22494
• article
  https://issues.redhat.com/browse/JBEAP-22500
• article
  https://issues.redhat.com/browse/JBEAP-22504
• article
  https://issues.redhat.com/browse/JBEAP-22515
• article
  https://issues.redhat.com/browse/JBEAP-22517
• article
  https://issues.redhat.com/browse/JBEAP-22522
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4676.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3629
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3629
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3629
• report
  https://access.redhat.com/security/cve/CVE-2021-3717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3717
• report
  https://access.redhat.com/security/cve/CVE-2021-20289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20289
• report
  https://access.redhat.com/security/cve/CVE-2021-30129