Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

JBoss Enterprise Application Platform 7.4.1 on RHEL 8 could let attackers bypass protections

published 2 years ago

Summary

The JBoss Enterprise Application Platform version 7.4.1 running on Red Hat Enterprise Linux 8 contains a flaw that could allow an unauthenticated user to bypass security controls or run code on the server. This could expose sensitive data or disrupt services. Install the Red Hat security update for JBoss EAP as soon as possible to close the gap.

What to do

Update redhat eap7-velocity to version 0:2.3.0-1.redhat_00001.1.el8eap.
Update redhat eap7-velocity-engine-core to version 0:2.3.0-1.redhat_00001.1.el8eap.
Update redhat eap7-wildfly to version 0:7.4.1-2.GA_redhat_00003.1.el8eap.
Update redhat eap7-wildfly-javadocs to version 0:7.4.1-2.GA_redhat_00003.1.el8eap.
Update redhat eap7-wildfly-modules to version 0:7.4.1-2.GA_redhat_00003.1.el8eap.
Update redhat eap7-undertow to version 0:2.2.9-2.SP1_redhat_00001.1.el8eap.
Update redhat eap7-wildfly-elytron to version 0:1.15.5-1.Final_redhat_00001.1.el8eap.
Update redhat eap7-wildfly-elytron-tool to version 0:1.15.5-1.Final_redhat_00001.1.el8eap.
Update redhat eap7-netty to version 0:4.1.63-1.Final_redhat_00001.1.el8eap.
Update redhat eap7-netty-all to version 0:4.1.63-1.Final_redhat_00001.1.el8eap.
Update redhat eap7-jakarta-el to version 0:3.0.3-2.redhat_00006.1.el8eap.
Update redhat eap7-apache-commons-io to version 0:2.10.0-1.redhat_00001.1.el8eap.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-velocity	< 0:2.3.0-1.redhat_00001.1.el8eap Fix: upgrade to 0:2.3.0-1.redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-velocity-engine-core	< 0:2.3.0-1.redhat_00001.1.el8eap Fix: upgrade to 0:2.3.0-1.redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-wildfly	< 0:7.4.1-2.GA_redhat_00003.1.el8eap Fix: upgrade to 0:7.4.1-2.GA_redhat_00003.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-wildfly-javadocs	< 0:7.4.1-2.GA_redhat_00003.1.el8eap Fix: upgrade to 0:7.4.1-2.GA_redhat_00003.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-wildfly-modules	< 0:7.4.1-2.GA_redhat_00003.1.el8eap Fix: upgrade to 0:7.4.1-2.GA_redhat_00003.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-undertow	< 0:2.2.9-2.SP1_redhat_00001.1.el8eap Fix: upgrade to 0:2.2.9-2.SP1_redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-wildfly-elytron	< 0:1.15.5-1.Final_redhat_00001.1.el8eap Fix: upgrade to 0:1.15.5-1.Final_redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-wildfly-elytron-tool	< 0:1.15.5-1.Final_redhat_00001.1.el8eap Fix: upgrade to 0:1.15.5-1.Final_redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-netty	< 0:4.1.63-1.Final_redhat_00001.1.el8eap Fix: upgrade to 0:4.1.63-1.Final_redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-netty-all	< 0:4.1.63-1.Final_redhat_00001.1.el8eap Fix: upgrade to 0:4.1.63-1.Final_redhat_00001.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-jakarta-el	< 0:3.0.3-2.redhat_00006.1.el8eap Fix: upgrade to 0:3.0.3-2.redhat_00006.1.el8eap
Red Hat:jboss_enterprise_application_platform:7.4::el8	redhat	eap7-apache-commons-io	< 0:2.10.0-1.redhat_00001.1.el8eap Fix: upgrade to 0:2.10.0-1.redhat_00001.1.el8eap

Original advisory text

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8

References

https://access.redhat.com/errata/RHSA-2021:3658 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_applicati... Third Party Advisory
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_applicati... Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1937364 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1937440 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1944888 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1948001 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1948752 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1965497 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1970930 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1976052 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1981407 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1991299 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-18402 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21231 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21257 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21258 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21261 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21263 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21270 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21276 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21277 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21281 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21300 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21309 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21313 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21472 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21569 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21777 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21781 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21818 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21961 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-21978 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22009 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22084 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22088 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22160 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22209 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22318 Third Party Advisory
https://issues.redhat.com/browse/JBEAP-22319 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3658.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2020-13936 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-13936 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-13936 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3536 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3536 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3536 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3597 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3597 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3597 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3642 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3642 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3642 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3644 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3644 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3644 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3690 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3690 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3690 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-21295 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-21295 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21295 Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-21409 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-21409 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21409 Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-28170 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-28170 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28170 Vendor Advisory
https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-29425 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-29425 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29425 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published20 Sep 2024

Updated21 Aug 2026

First seen21 Aug 2026

Sources

RHSA-2021:3658 · OSV

Track software like this

Free during beta

JBoss Enterprise Application Platform 7.4.1 on RHEL 8 could let attackers bypass protections

JBoss Enterprise Application Platform 7.4.1 on RHEL 8 could let attackers bypass protections