Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2132
Open Liberty 21.0.0.6 Runtime security update
16 June 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Open Liberty 21.0.0.6 Runtime
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Cross-site Request Forgery -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-26296
Reference: ESB-2021.1811
ESB-2021.1321
ESB-2021.1200
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:2439
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Open Liberty 21.0.0.6 Runtime security update
Advisory ID: RHSA-2021:2439-01
Product: Open Liberty
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2439
Issue date: 2021-06-15
=====================================================================
1. Summary:
Open Liberty 21.0.0.6 Runtime is now available from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Open Liberty is a lightweight open framework for building fast and
efficient cloud-native Java microservices.
This release of Open Liberty 21.0.0.6 serves as a replacement for Open
Liberty 21.0.0.3, and includes a security fix and enhancements. For
specific information about this release, see links in the References
section.
Security Fix(es):
* myfaces: Cross-site request forgery vulnerability in Apache MyFaces
(CVE-2021-26296)
For more details about the security issue(s), see the IBM Security Bulletin
links for each CVE, listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link (you must
log in to download the update).
4. JIRA issues fixed (https://issues.jboss.org/):
IBMRT-133 - Create Errata (RHSA) for Open Liberty
5. References:
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=open.liberty&downloadType=distributions&version=21.0.0.6
https://www.ibm.com/support/pages/node/6441433
https://access.redhat.com/articles/4544981
https://access.redhat.com/products/open-liberty
https://access.redhat.com/documentation/en-us/open_liberty/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYMimftzjgjWX9erEAQhrsA//Y0ojMf2eAgzAzR8wlmNm8WmzB57R2j4d
6NWTmOLcgxOtqah3YHlJwpNmd3TCnLewNZPvYWFHYtu/OlQThItno89xN6ttadQt
xOVX+lI5f9Ks3xo0EyO/8RhmSHTs6goGVK3spjkgjNMh+Gb2BuReFxx+LKAySiyS
QMMV90A46/HPfFlPYtlQTpVmISe1efeG2aCbvCFZDTUbm4luSxTThL1CsNpeE+1A
/5d8RG64269/1VLN/z9SnkpOO/0mMPmNXroC3+Y9XBfVt1rdDlzKskvlQkdoifix
7mpyEu66Q1wL3K9qTuzf939Avd4Eha1V/gHQAcrBuwPVofm9OZ3Vkgog9Q1bXWmp
UACXXfY+obV3eNveLqVpDdwt/DlUQKwWb1nbi8S43uYgXnaM03W1POgFoFTJ2QPT
QKs2f1ZeAWVN1CuORY/Q8OTo79EDEeNgjia874uk87pdbHtoxe8VwUiTVIeL+049
kHlJbqwhk5Fp2G7qfaDrQT+J/Lo8KxRcSI+akhQGknPdK9OFNiUM1TcgINk3qsTQ
znUfcqoHnsYFoEfcG3sWc7UWMp7WK6q83lNn8jf87xb4JTlr8qzjenNn55oTaCoe
DqEn/kMPTbb3hqZ6i0Jjej4/RdiA/oM6IWAD7gZ5HZoUSU1GbwyGVPoYSb0brT1J
W1Q0HnRVJlU=
=mOIE
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYMlhCONLKJtyKPYoAQiThxAAmMzbf3N3n6daadc8LsVfNzjzobzZWuvx
MXSvaDUcKkyV50UR0Jvp1bqspUttd+Zwxo6a3wcwZVFF4UlZ1Z/sBgeyguJFsY3p
fxdQY0xzp0MuiESiF5wMfj9XmUSSCwFVA/iLybZsrE1/wZXydbFKdovMABMZKm/H
geV3NRwTzO60CYmpowkfEbG/BTb2C51KlrTtB/00BBVxxZQb+xmJU7XUOJCfOf05
SRW6e1y6l2iz0MZKsyLEI/91vZHxPGC/euFzV5lnMXvRtZsXUHFeg72F/cZQVbju
Hx+Ld5xK5483GUGLP0K70m1Mp9wkPpyX35jzGRTcjz0Tf3dPwk2bTDxsuLg32dQC
a9lrVtsMW8xO2oRzc2MoMHkmYAdeGAxkxKzgMTvvL9jJrSX9PEhM8Qncz5UDAw1v
mMmPdK8X66bU4f2lP2BLAfXG2aVHW6nWrsU3wGS29LN78HCaRuYnVvluB1a6NBzS
26/j3k8mtUOarP312q2x2zhOc2L4yGGEimlTF2WFL96ahp4ZY3gPChl8OVlZIrU7
rC5uIT+k2bXktPHqdbJIWaD4akHPj8XOdx/6OrMCsx2aKzc72Xq7LRAx/L+6wOU9
onM0L+/J8Tk71DiroXHebyLa4cUgEWAS+M9hjLaPZq/vxlgzOHKUPG9qWaVMDZlA
bnnavW1gzxs=
=XArP
-----END PGP SIGNATURE-----