-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: EAP Continuous Delivery Technical Preview Release
 14 security update
Advisory ID:       RHSA-2020:2563-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:2563
Issue date:        2020-06-15
CVE Names:         CVE-2017-7465 CVE-2017-7503 
=====================================================================

1. Summary:

This is a security update for JBoss EAP Continuous Delivery 14.0.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform CD14 is a platform for Java
applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform CD14 includes
bug fixes and enhancements. 

Security Fix(es):

* XML Frameworks: JBoss: JAXP in EAP 7.0 allows RCE via XSL (CVE-2017-7465)

* XML Frameworks: TransformerFactory in JBoss EAP 7 is vulnerable to XXE 
(CVE-2017-7503)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

The References section of this erratum contains a download link (you must
log in to download the update)

4. Bugs fixed (https://bugzilla.redhat.com/):

1439980 - CVE-2017-7465 JBoss: JAXP in EAP 7.0 allows RCE via XSL
1451960 - CVE-2017-7503 EAP: XXE issue in TransformerFactory

5. References:

https://access.redhat.com/security/cve/CVE-2017-7465
https://access.redhat.com/security/cve/CVE-2017-7503
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=eap-cd&version=14

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXuefhdzjgjWX9erEAQhAlxAAmBc/npuEUSQ+mINPSy7w/B4E4A84TCdF
b0Hp05Kaz1rIcwS7kBeuspKNPIwckTmTlXwRrwMlUBVxCyxzZWItWRtM+yBeWwLJ
tbtDmVrZtJ81ZTiduS7W96r9f4QtmoDH0a9vsaFZq3SdATELq49O204T+PSTebqu
VgoTnDY7FzXickAOUl7JMTP2IupjlSdUe4FG+kHOL1qZqKPFXSOJEtv4gLTa0Wwp
JcwnA/oj2yd2c1kuNXR1+49oBGutgipB5SSLVO6LCwAzEBvDWxg+NtiInONqT5Fm
rcw3hJpWojW6k3U3a5XHMy9yUmCuNKfrHe+V/A1XotBexopDRoExpQNgAPH0a8A1
iuuCMWLvXkgYd8lfxt9ai5VVE+1lhl1f4GyWsKmO96EeNU2BxbzI21N+rtqWaOJf
MNheQs1zrLHFbDCC6ZRSozZfzQFivkYq1FrPcYKnBR+wRHdkVrkq/2cIpV1r75tW
OSL7HNSb+JRMflTuNIidQSIloXCCO5724McepOte48QhPOxIHyFuQS4974BB/4D+
TmeCkKyuqvcGOGgswYjo9ukMapoox/3ypAyV4NUBqJxqUsBgzR3ybd/rRObRajjt
68aGXoIprM0etxHYXkJhWlvV6rvku7vyELVgK1R/S03WMbkTAD/uzTPZaEjuF5GV
a2DmpK7QXIU=
=vXbI
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce