Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.2416 EAP XP 2 security update to CVE fixes in the EAP 7.3.x base 16 July 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: EAP XP 2 Publisher: Red Hat Operating System: Red Hat Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Access Confidential Data -- Remote/Unauthenticated Cross-site Scripting -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2021-21409 CVE-2021-21295 CVE-2021-21290 CVE-2021-20250 CVE-2021-20220 CVE-2021-3536 CVE-2020-28052 CVE-2020-15522 CVE-2020-13936 CVE-2020-10687 Reference: ASB-2021.0073 ASB-2021.0066 ESB-2021.2363 ESB-2021.2245 ESB-2021.1924 Original Bulletin: https://access.redhat.com/errata/RHSA-2021:2755 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: EAP XP 2 security update to CVE fixes in the EAP 7.3.x base Advisory ID: RHSA-2021:2755-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:2755 Issue date: 2021-07-15 CVE Names: CVE-2020-13936 CVE-2020-15522 CVE-2020-28052 CVE-2021-3536 CVE-2021-20220 CVE-2021-20250 CVE-2021-21290 CVE-2021-21295 CVE-2021-21409 ===================================================================== 1. Summary: This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes associated with it. No action is required. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: These are CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP2 code base. Security Fix(es): * velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936) * bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052) * bouncycastle: Timing issue within the EC math library (CVE-2020-15522) * undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220) * wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client (CVE-2021-20250) * netty: Information disclosure via the local system temporary directory (CVE-2021-21290) * netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295) * netty: Request smuggling via content-length header (CVE-2021-21409) * wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: This advisory is informational only. There are no code changes associated with it. No action is required. 4. Bugs fixed (https://bugzilla.redhat.com/): 1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible 1923133 - CVE-2021-20220 undertow: Possible regression in fix for CVE-2020-10687 1927028 - CVE-2021-21290 netty: Information disclosure via the local system temporary directory 1929479 - CVE-2021-20250 wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client 1937364 - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation 1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 1948001 - CVE-2021-3536 wildfly: XSS via admin console when creating roles in domain mode 1962879 - CVE-2020-15522 bouncycastle: Timing issue within the EC math library 5. JIRA issues fixed (https://issues.jboss.org/): JBEAP-22122 - XP 2.0.0 respin (2.0.0-7.3.8.GA) 6. References: https://access.redhat.com/security/cve/CVE-2020-13936 https://access.redhat.com/security/cve/CVE-2020-15522 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2021-3536 https://access.redhat.com/security/cve/CVE-2021-20220 https://access.redhat.com/security/cve/CVE-2021-20250 https://access.redhat.com/security/cve/CVE-2021-21290 https://access.redhat.com/security/cve/CVE-2021-21295 https://access.redhat.com/security/cve/CVE-2021-21409 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/ https://access.redhat.com/articles/5975301 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYPBTitzjgjWX9erEAQjULQ//dqoecZtz+8zCi1Ol+lvRNTDUSiLzYCr8 Z0A3cH+s0WmMPNZiM2yZ/oykjD3ANDckf4KEBdh+ONtYGBXQKyW7VUBZVJxw6uk8 5mZMM/KlIOSPsL2LdYnnIC1OHw971Sq2hzwqWWKkMLPjOHyi1LcTfY4doFIBbRb/ njy+/dXVgZzUOJLb5Fk4/1PiXFKlTLc2+hNCpBkZGr4bgOaMChQIo/bp9xltMyQx o+Tj23ipS4FNsyLOWJ4LLAfhNMX8UycHZxbyferFmSvBH35cw+dzi7YIvh8m/WeP QIxa9ag1p0Tk9fFwLwP5OnCTCCh0ITixJanqTENUuJvjTZ0BqWICssWPpoqd4REt UvulVEQfNY34Gjs2ivYlBFuKiZoOTDQiQHtaUiAlTBln14ppRDyCyDNV9YdatPQZ NzNTEzvZbthKGdF8eW6epLWy6YFWUhXyF6SQRk20pyJZ4Aqr3MioCjnU1XjX4lks VUnDBkJiY6f+TLwosSQojdBle/g9QFubvA+wG/ZpGVyI5Z194fWRwjZGEBTtwYTY +KoVjP9iTu/y2N0nj6Mtj9tAAUiwuR4QA7qDA7fG8BsL36lQCRIDSMKd3/xOS0f9 S1GtgSkLjWYcCUkGGRdmFwkVQc7GSMYV7Ysy+wOJYPsrSNcgbRhUZW4EdErPbH5t O9QuLVofSBU= =j6f5 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYPD1rONLKJtyKPYoAQhI7w/8CyBywAOYwkVxGmdzW9Mzk+tpC+IPorYq LS76l6wbOpr428vxrvcOObq7iNBqx2J7l9Qsuk1cS8Lw4w71m72L2wKb8qUWJF76 RRbJVJNUEMlptuK0H1MrPHsNOwugMrzWmhUiLRK9T4FmnJnPhz87o6D5QKTqmGP6 Dz5/mqiAETSrI8V6WwqjaXQpbHSR2TnAEKrvtUE+7hNpuEp4l0CiA+ZGdUKzKqTL XUMmP0vx2WJLbnrZ9p8wW7bznVDk970upA20RsW2+liomEZS5JuUuy8ryVl/EInD FkEI9BjxXEzWsjT64I/GQJ1F3jrg6YXfdVtDVuifcXLBb4husIUUSMXatYvmci6w 818BiuGqVETbDnAc6QDULyUOk6I4wN/6itRLvaxwmDBVMgs1XLLPHvMrhrLWV77h adqTI8aTDR+1YHEcOxwBaeQiQJ6JP+a/ElapMb50avTIydIyzQm9bovHOkZs2/oD 7Pp8xrMwZlMUsbLAJVib14iNuZfBOJaS4kuxyl863Vmn10g5vsqth6KTBRzKI7Y0 vw+mBiBQZbuf/J6QN1h/PNlugHUMPLmF+s3szNCXTcPaJrjbqYjqpvvLGBw4ZG1o MHPB5NT0yEUSqzjcLN/vfXp4nDDNOq/5mDDpx3YEPizQ+s0RoDz9BOybP4gTBqhK wAhR2fciyOk= =h8DZ -----END PGP SIGNATURE-----