RHSA-2020:5361: Important: Red Hat build of Thorntail 2.7.2 security and bug fix update
First published: Wed Dec 16 2020(Updated: )
This release of Red Hat build of Thorntail 2.7.2 includes security updates, bug fixes, and enhancements. For more information, see the release notes listed in the References section.<br>Security Fix(es):<br><li> picketbox: JBoss EAP reload to admin-only mode allows authentication bypass (CVE-2020-14299)</li> <li> xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS (CVE-2020-14340)</li> <li> wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl (CVE-2020-14338)</li> <li> hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used </li> (CVE-2020-25638)<br><li> jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649)</li> For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =2.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1848533
- https://bugzilla.redhat.com/show_bug.cgi?id=1860054
- https://bugzilla.redhat.com/show_bug.cgi?id=1860218
- https://bugzilla.redhat.com/show_bug.cgi?id=1881353
- https://bugzilla.redhat.com/show_bug.cgi?id=1887664
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.7.2
- https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.7/html/release_notes_for_thorntail_2.7/
- https://access.redhat.com/errata/RHSA-2020:5361 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2020:5361?
The severity of RHSA-2020:5361 is classified as important.
How do I fix RHSA-2020:5361?
To fix RHSA-2020:5361, update your Red Hat build of Thorntail to the latest version specified in the advisory.
What vulnerabilities are addressed in RHSA-2020:5361?
RHSA-2020:5361 addresses vulnerabilities related to picketbox which allows authentication bypass under certain conditions.
Is RHSA-2020:5361 related to JBoss EAP?
Yes, RHSA-2020:5361 is related to JBoss EAP as it includes security updates relevant to that framework.
When was the RHSA-2020:5361 advisory released?
The RHSA-2020:5361 advisory was released on December 14, 2020.
- agent/severity
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2020:5361
- agent/trending
- agent/weakness
- agent/references
- agent/title
- agent/remedy
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup