Red Hat Security AdvisoryRHSA-2020:2063
Red Hat JBoss Enterprise Application Platform 7.2 security update
Released 2020-05-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el6eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el6eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el6eap +7
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el7eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el7eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el7eap +7
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el8eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el8eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el8eap +7
Fixes 2 records
Priority MEDIUM 44
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03089 · Published 2019-11-25 · Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
Priority MEDIUM 40
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04425 · Published 2018-07-18 · Partial fix · 2.3.7 CWE-22
