RHSA-2020:3144HighCVSS 7.5
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update
🔗 CVE IDs covered (3)
📋 Description
CVE-2020-10740 — wildfly: unsafe deserialization in Wildfly Enterprise Java Beans CVE-2020-14297 — wildfly: Some EJB transaction objects may get accumulated causing Denial of Service CVE-2020-14307 — wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
🎯 Affected products1
- Red Hat JBoss EAP 7.2
✅ Remediation
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. You must restart the JBoss server process for the update to take effect. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is currently no known mitigation for this issue.
🔗 References (9)
- selfhttps://access.redhat.com/errata/RHSA-2020:3144
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.2
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1834512
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1851327
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1853595
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3144.json