drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in EAP XP 1
Name: |
Mehrere Probleme in EAP XP 1 |
|
ID: |
RHSA-2021:2210-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat JBoss Enterprise Application Platform |
|
Datum: |
Mi, 2. Juni 2021, 23:34 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2020-8908
https://access.redhat.com/security/cve/CVE-2020-13936
https://access.redhat.com/articles/5886431
https://access.redhat.com/security/cve/CVE-2021-20250
https://access.redhat.com/security/cve/CVE-2020-35510
https://access.redhat.com/security/cve/CVE-2021-21290
https://access.redhat.com/security/cve/CVE-2020-28052
https://access.redhat.com/security/cve/CVE-2021-20220
https://access.redhat.com/articles/5734021 |
|
Applikationen: |
EAP XP 1 |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: EAP XP 1 security update to CVE fixes in the EAP 7.3.x base Advisory ID: RHSA-2021:2210-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:2210 Issue date: 2021-06-02 CVE Names: CVE-2020-8908 CVE-2020-13936 CVE-2020-28052 CVE-2020-35510 CVE-2021-20220 CVE-2021-20250 CVE-2021-21290 =====================================================================
1. Summary:
This advisory resolves CVE issues filed against XP1 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP1 code base.
NOTE: This advisory is informational only. There are no code changes associated with it. No action is required.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Description:
These are CVE issues filed against XP1 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP1 code base.
Security Fix(es):
* velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)
* bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)
* jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client (CVE-2020-35510)
* undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)
* wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client (CVE-2021-20250)
* netty: Information disclosure via the local system temporary directory (CVE-2021-21290)
* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
3. Solution:
This advisory is informational only. There are no code changes associated with it. No action is required.
4. Bugs fixed (https://bugzilla.redhat.com/):
1905796 - CVE-2020-35510 jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client 1906919 - CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions 1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible 1923133 - CVE-2021-20220 undertow: Possible regression in fix for CVE-2020-10687 1927028 - CVE-2021-21290 netty: Information disclosure via the local system temporary directory 1929479 - CVE-2021-20250 wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client 1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates
5. References:
https://access.redhat.com/security/cve/CVE-2020-8908 https://access.redhat.com/security/cve/CVE-2020-13936 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2020-35510 https://access.redhat.com/security/cve/CVE-2021-20220 https://access.redhat.com/security/cve/CVE-2021-20250 https://access.redhat.com/security/cve/CVE-2021-21290 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/articles/5734021 https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide https://access.redhat.com/articles/5886431
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYLeUktzjgjWX9erEAQgwuxAAoE5FcOBf75luy5b546Zm+KLrc+lHXMWn kjQ/yRJLCeabKIYQH091A15uqJxiTMcb+0poM2oHBTDEYmbKbDxUhWw2Q+eCkVhF 6OdzLy3FU9qMLi2WtS6US4Mtk0xUaEDr8VWd09RRqWB7IQYZiq93Dx7LVrwIpOUV EpMLm+CwnALmNdLUMEbMm5mqhD7UUGFx2/iRyP/tTAqjW3uOkxDCQ/wCm32fxqTp sEEgyBJHEoK+XZtuQKRhjHqweelCKCjK31WuiegNnPB1ZYXU2uZFtjBdeKg4BeoA 7UC8wHAvx1dqgGOKooECW+CaIZ+kXLwZuaSBMBiYdfcCpJz3vYTBlBGW2tZnftT3 o8q5UOiMTpSs6letZFlyoA+HmS3emh58RF1VCyAaQ7UTsFohFIxRCyg1PxTfQNLf BVT9uOBP7L5yksrt+cxe8f0PPr6Krz4g09nPJCM8RQInjh4qHGeFgjuUrGy+aLgk cxfQoNgUFrpNw/DvV+K7OZ9Ut4TsP+9FgrZfXA4diekB4Lzq8WNC7C8HBBxy3t3n RagO+V5kZT77ulNnXVG3rr1X8SWPXd4sk8VY7BAwjX1X2XoE7gogRzoojh7AKGwV BdrpRmBdXoHnIocuVOkgVx3pjP2fxhVG93lAkKv3KjBHBAtQZ3ujzkAT7uKOCbPD oMoAg+Ex0fU= =+Ekz -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|