RHSA-2019:4020HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update

Published
November 26, 2019
Last Modified
August 15, 2026

🔗 CVE IDs covered (6)

CVE-2019-9512 →CVE-2019-9514 →CVE-2019-9515 →CVE-2019-14838 →CVE-2019-14843 →CVE-2019-9511 →

📋 Description

CVE-2019-9511 — HTTP/2: large amount of data requests leads to denial of service CVE-2019-9512 — HTTP/2: flood using PING frames results in unbounded memory growth CVE-2019-9514 — HTTP/2: flood using HEADERS frames results in unbounded memory growth CVE-2019-9515 — HTTP/2: flood using SETTINGS frames results in unbounded memory growth CVE-2019-14838 — wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default CVE-2019-14843 — wildfly-security-manager: security manager authorization bypass

🎯 Affected products120

  • Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-apache-cxf-0:3.2.10-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-apache-cxf-0:3.2.10-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-apache-cxf-rt-0:3.2.10-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-apache-cxf-services-0:3.2.10-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-apache-cxf-tools-0:3.2.10-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-byte-buddy-0:1.9.11-1.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-byte-buddy-0:1.9.11-1.redhat_00002.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-glassfish-jsf-0:2.3.5-5.SP3_redhat_00003.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-glassfish-jsf-0:2.3.5-5.SP3_redhat_00003.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hal-console-0:3.0.17-2.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hal-console-0:3.0.17-2.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-0:5.3.13-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-0:5.3.13-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-core-0:5.3.13-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-entitymanager-0:5.3.13-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-envers-0:5.3.13-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-hibernate-java8-0:5.3.13-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-0:1.4.18-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-common-api-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-common-impl-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-common-spi-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-core-api-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-core-impl-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-deployers-common-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-jdbc-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-ironjacamar-validator-0:1.4.18-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-jboss-genericjms-0:2.0.2-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • eap7-jboss-genericjms-0:2.0.2-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.2 for RHEL 8
  • +90 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. For details about how to apply this update, see: https://access.redhat.com/articles/11258 Workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3 Workaround: This flaw only affects the Security Manager running under JDK 11 or 8. To mitigate exposure to this flaw, do not run under those JDK versions.

🔗 References (34)