Red Hat Security Advisory

RHSA-2021:2047

Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7

Released 2021-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el7eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el7eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el7eap +47

Fixes 3 records

TI-2020-10913 CVE-2020-13936 · GHSA-59j4-wjwp-mw9m

Velocity Sandbox Bypass

MEDIUM 58

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22709 Published 2021-03-10 Partial fix · 2.3 CWE-20

TI-2021-04395 CVE-2021-21295 · GHSA-wm47-8v5p-wjpj

Possible request smuggling in HTTP/2 due missing validation

MEDIUM 50

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.18891 Published 2021-03-09 Partial fix · 4.1.60.Final CWE-444

TI-2021-04390 CVE-2021-21290 · GHSA-5mcr-gq6c-3hq2

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

LOW 31

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.01799 Published 2021-02-08 Partial fix · 4.1.59.Final CWE-378