Red Hat Security Advisory

RHSA-2020:4247

Red Hat JBoss Enterprise Application Platform 7.3.3 security update

Released 2020-10-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

EAP 7.3.3

Fixes 4 records

TI-2020-01878 CVE-2020-1954 · GHSA-ffm7-7r8g-77xm

Information disclosure in Apache CXF

LOW 33

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.06147 Published 2020-04-01 Partial fix · 3.2.13, 3.3.6 CWE-200

TI-2020-11170 CVE-2020-14299 · GHSA-vx2g-h7fh-g3vj

Improper authentication in picketbox

LOW 32

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01377 Published 2020-10-16 Partial fix CWE-287

TI-2020-11211 CVE-2020-14340 · GHSA-c738-77x8-wmq5

Uncontrolled resource consumption in XNIO

LOW 31

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02212 Published 2021-06-02 Partial fix · 3.8.2.Final, 3.7.9.Final CWE-400

TI-2020-11209 CVE-2020-14338 · GHSA-w4jq-qh47-hvjq

Improper input validation in Wildfly

LOW 27

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01292 Published 2020-09-17 Partial fix · 2.12.0.sp3 CWE-20