Red Hat Security Advisory

RHSA-2021:2210

EAP XP 1 security update to CVE fixes in the EAP 7.3.x base

Released 2021-06-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat EAP-XP via EAP 7.3.x base

Fixes 7 records

TI-2020-10913 CVE-2020-13936 · GHSA-59j4-wjwp-mw9m

Velocity Sandbox Bypass

MEDIUM 58

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22709 Published 2021-03-10 Partial fix · 2.3 CWE-20

TI-2020-17076 CVE-2020-28052 · GHSA-73xv-w5gp-frxh

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.

MEDIUM 45

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07225 Published 2020-12-18 Partial fix · 1.67 CWE-670

TI-2021-04390 CVE-2021-21290 · GHSA-5mcr-gq6c-3hq2

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

LOW 31

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.01799 Published 2021-02-08 Partial fix · 4.1.59.Final CWE-378

TI-2020-18031 CVE-2020-35510 · GHSA-p6j8-hgv5-m35g

Uncontrolled resource consumption in jboss-remoting

LOW 29

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01089 Published 2021-06-02 Partial fix · 5.0.20.Final CWE-400

TI-2021-03516 CVE-2021-20220 · GHSA-qjwc-v72v-fq6r

A flaw was found in Undertow.

LOW 24

A flaw was found in Undertow.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.012 Published 2021-02-23 Partial fix · 2.1.6, 2.0.34 CWE-444

TI-2021-03542 CVE-2021-20250 · GHSA-2259-h742-5vr4

Information disclosure in wildfly

LOW 21

A flaw was found in wildfly.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00743 Published 2021-05-13 Partial fix · 4.0.39 CWE-200

TI-2020-07155 CVE-2020-8908 · GHSA-5mg8-w23w-74h3

Temp directory permission issue in Guava

LOW 18

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.F…

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00924 Published 2020-12-10 Partial fix · 32.0, 32.0.0-android CWE-378