Red Hat Security Advisory

RHSA-2020:0962

Red Hat JBoss Enterprise Application Platform 7.3 security update

Released 2020-03-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap +5
Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap +5
Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap +5

Fixes 4 records

TI-2020-01688 CVE-2020-1745 · GHSA-gv2w-88hx-8m9r

Improper authorization in undertow-io undertow

MEDIUM 50

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04957 Published 2020-04-28 Partial fix · 2.0.30 CWE-285

TI-2019-00181 CVE-2019-0205 · GHSA-rj7p-rfgp-852x

Infinite loop in Apache Thrift

MEDIUM 45

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09156 Published 2019-10-28 Partial fix · 0.13.0 CWE-835

TI-2019-00183 CVE-2019-0210 · GHSA-jq7p-26h5-w78r

Out-of-bounds read in Apache Thrift

MEDIUM 42

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06531 Published 2019-10-28 Partial fix · 0.13.0 CWE-125

TI-2019-11091 CVE-2019-14887 · GHSA-rvxx-gx2m-h7rc

A flaw was found when an OpenSSL security provider is used with Wildfly, the…

MEDIUM 41

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01095 Published 2020-03-16 Partial fix CWE-757