RHSA-2020:3141: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update

Q: What is the severity of RHSA-2020:3141?

The severity of RHSA-2020:3141 is categorized as important.

Q: How do I fix RHSA-2020:3141?

To fix RHSA-2020:3141, you should update to the patched versions of the affected packages listed in the advisory.

Q: Which software packages are affected by RHSA-2020:3141?

RHSA-2020:3141 affects multiple packages including eap7-jboss-ejb-client, eap7-wildfly, and eap7-wildfly-http-client.

Q: Is RHSA-2020:3141 applicable to all Red Hat Enterprise Linux versions?

RHSA-2020:3141 is applicable to Red Hat Enterprise Linux versions 6, 7, and 8.

Q: What kind of vulnerabilities does RHSA-2020:3141 address?

RHSA-2020:3141 addresses security vulnerabilities found in Red Hat JBoss Enterprise Application Platform 7.

Published Jul 23, 2020

Updated

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.Security Fix(es): wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740) jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service (CVE-2020-14307) jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297) For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

Affected Software

33 affected componentsFixes available

redhat/eap7-jboss-ejb-client<4.0.33-2.SP1_redhat_00001.1.el8ea

4.0.33-2.SP1_redhat_00001.1.el8ea

redhat/eap7-wildfly<7.3.1-7.GA_redhat_00004.1.el8

7.3.1-7.GA_redhat_00004.1.el8

redhat/eap7-wildfly-http-client<1.0.21-1.Final_redhat_00001.1.el8ea

1.0.21-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly-naming-client<1.0.13-1.Final_redhat_00001.1.el8ea

1.0.13-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly<7.3.1-7.GA_redhat_00004.1.el8

7.3.1-7.GA_redhat_00004.1.el8

redhat/eap7-wildfly-http-client-common<1.0.21-1.Final_redhat_00001.1.el8ea

1.0.21-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly-http-ejb-client<1.0.21-1.Final_redhat_00001.1.el8ea

1.0.21-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly-http-naming-client<1.0.21-1.Final_redhat_00001.1.el8ea

1.0.21-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly-http-transaction-client<1.0.21-1.Final_redhat_00001.1.el8ea

1.0.21-1.Final_redhat_00001.1.el8ea

redhat/eap7-wildfly-javadocs<7.3.1-7.GA_redhat_00004.1.el8

7.3.1-7.GA_redhat_00004.1.el8

redhat/eap7-wildfly-modules<7.3.1-7.GA_redhat_00004.1.el8

7.3.1-7.GA_redhat_00004.1.el8

redhat/eap7-jboss-ejb-client<4.0.33-2.SP1_redhat_00001.1.el7ea

4.0.33-2.SP1_redhat_00001.1.el7ea

redhat/eap7-wildfly<7.3.1-7.GA_redhat_00004.1.el7ea

7.3.1-7.GA_redhat_00004.1.el7ea

redhat/eap7-wildfly-http-client<1.0.21-1.Final_redhat_00001.1.el7ea