Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8

Fixed packages 72

Vulnerabilities 6

• High 7.8
  CVE-2021-3717

  Wildfly-Core user account mismanagement

  A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…

  org.wildfly.core:wildfly-core-parent Maven
  May 24, 2022
• High 7.5
  CVE-2021-3629

  Undertow Uncontrolled Resource Consumption

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Und…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  May 24, 2022
• High 7.5
  CVE-2021-37714

  Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

  jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to ge…

  jhy jsoup org.jsoup:jsoup jsoup Debian Ubuntu Azure Linux Maven
  Aug 18, 2021
• High 7.5
  CVE-2021-40690

  Bypass of the secureValidation property

  All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…

  Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven
  Sep 19, 2021
• Medium 5.3
  CVE-2021-20289

  Exposure of class information in RESTEasy

  A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…

  resteasy resteasy3.0 org.jboss.resteasy:resteasy-core Ubuntu Maven
  Mar 26, 2021
• Medium 5.3
  CVE-2021-3642

  Observable Discrepancy in Wildfly Elytron

  A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

  org.wildfly.security:wildfly-elytron Maven
  Aug 5, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1935927
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1977362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995259
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2011190
• article
  https://issues.redhat.com/browse/JBEAP-22145
• article
  https://issues.redhat.com/browse/JBEAP-22314
• article
  https://issues.redhat.com/browse/JBEAP-22332
• article
  https://issues.redhat.com/browse/JBEAP-22343
• article
  https://issues.redhat.com/browse/JBEAP-22363
• article
  https://issues.redhat.com/browse/JBEAP-22490
• article
  https://issues.redhat.com/browse/JBEAP-22501
• article
  https://issues.redhat.com/browse/JBEAP-22523
• article
  https://issues.redhat.com/browse/JBEAP-22734
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5151.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3629
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3629
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3629
• report
  https://access.redhat.com/security/cve/CVE-2021-3642
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3642
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3642
• report
  https://access.redhat.com/security/cve/CVE-2021-3717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3717
• report
  https://access.redhat.com/security/cve/CVE-2021-20289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20289
• report
  https://access.redhat.com/security/cve/CVE-2021-37714
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37714
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37714
• article
  https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
• report
  https://access.redhat.com/security/cve/CVE-2021-40690
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-40690
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-40690
• article
  https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E