Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat JBoss EAP XP2 RHSA-2021-3516-01 Important DoS Fixes

red hat
Calendar Grey September 13, 2021
Dist Redhat Esm H88
Significant news on EAP XP2 tackling vital CVE vulnerabilities, no adjustments or intervention necessary.
This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base

Solution

This advisory is informational only. There are no code changes associated with it. No action is required.

Summary

These are CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP2 code base.
Security Fix(es):
* undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
* undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)
* jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
* apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)
* wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat DoS security impact CVE issues JBoss EAP XP2

References

https://access.redhat.com/security/cve/CVE-2021-3597 https://access.redhat.com/security/cve/CVE-2021-3644 https://access.redhat.com/security/cve/CVE-2021-3690 https://access.redhat.com/security/cve/CVE-2021-28170 https://access.redhat.com/security/cve/CVE-2021-29425 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/ https://access.redhat.com/articles/6179301

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2021:3516-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3516
Issue date: 2021-09-13

Topic

This advisory resolves CVE issues filed against XP2 releases that have beenfixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2code base.NOTE: This advisory is informational only. There are no code changesassociated with it. No action is required.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat DoS security impact CVE issues JBoss EAP XP2

Relevant Releases Architectures

Bugs Fixed

1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS

1976052 - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression

1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS

5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects):

JBEAP-22409 - XP 2.0.0 respin (2.0.0-7.3.9.GA)

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here