RHSA-2020:4402HighCVSS 7.5
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
🎯 Affected products1
- Red Hat JBoss Enterprise Application Platform 7
✅ Remediation
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). You must restart the JBoss server process for the update to take effect. Workaround: There is currently no known mitigation for this flaw.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2020:4402
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.3
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1887664
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4402.json