What is the severity of RHSA-2021:3658?

The severity of RHSA-2021:3658 is classified as moderate.

How do I fix RHSA-2021:3658?

To fix RHSA-2021:3658, you should update your Red Hat JBoss Enterprise Application Platform to version 7.4.1 or higher.

Which versions are affected by RHSA-2021:3658?

Affected versions include Red Hat JBoss Enterprise Application Platform 7.4.0 and earlier.

What packages need to be updated for RHSA-2021:3658?

Packages including eap7-apache-commons-io, eap7-artemis-wildfly-integration, and eap7-hibernate among others need to be updated.

Is RHSA-2021:3658 part of a larger vulnerability issue?

Yes, RHSA-2021:3658 addresses multiple vulnerabilities identified in the Red Hat JBoss Enterprise Application Platform.

Vulnerability/
RHSA-2021:3658

CWE

79 22

23/9/2021

RHSA-2021:3658: Important: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8

First published: Thu Sep 23 2021(Updated: )

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.<br>This release of Red Hat JBoss Enterprise Application Platform 7.4.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.0 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.1 Release Notes for information about the most significant bug fixes and enhancements included in this release.<br>Security Fix(es):<br><li> velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)</li> <li> undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)</li> <li> undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)</li> <li> wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)</li> <li> netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)</li> <li> netty: Request smuggling via content-length header (CVE-2021-21409)</li> <li> jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)</li> <li> apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)</li> <li> wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)</li> <li> wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of RHSA-2021:3658?
The severity of RHSA-2021:3658 is classified as moderate.
How do I fix RHSA-2021:3658?
To fix RHSA-2021:3658, you should update your Red Hat JBoss Enterprise Application Platform to version 7.4.1 or higher.
Which versions are affected by RHSA-2021:3658?
Affected versions include Red Hat JBoss Enterprise Application Platform 7.4.0 and earlier.
What packages need to be updated for RHSA-2021:3658?
Packages including eap7-apache-commons-io, eap7-artemis-wildfly-integration, and eap7-hibernate among others need to be updated.
Is RHSA-2021:3658 part of a larger vulnerability issue?
Yes, RHSA-2021:3658 addresses multiple vulnerabilities identified in the Red Hat JBoss Enterprise Application Platform.

agent/weakness
agent/type
agent/severity
agent/first-publish-date
agent/softwarecombine
agent/last-modified-date
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2021:3658
agent/software-canonical-lookup
agent/remedy
agent/references
agent/title
agent/description
agent/event
agent/trending
agent/tags
agent/source
package-manager/redhat