RHSA-2020:3143HighCVSS 7.5
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update
🔗 CVE IDs covered (3)
📋 Description
CVE-2020-10740 — wildfly: unsafe deserialization in Wildfly Enterprise Java Beans CVE-2020-14297 — wildfly: Some EJB transaction objects may get accumulated causing Denial of Service CVE-2020-14307 — wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
🎯 Affected products1
- Red Hat JBoss Enterprise Application Platform 7
✅ Remediation
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). You must restart the JBoss server process for the update to take effect. Workaround: There is currently no known mitigation for this issue.
🔗 References (9)
- selfhttps://access.redhat.com/errata/RHSA-2020:3143
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.3
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1834512
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1851327
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1853595
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3143.json