RHSA-2020:4961MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Process Automation Manager 7.9.0 security update

Published
November 5, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (11)

CVE-2020-10714 →CVE-2019-17566 →CVE-2020-1748 →CVE-2020-1945 →CVE-2020-1954 →CVE-2020-2875 →CVE-2020-2934 →CVE-2020-10693 →CVE-2019-14900 →CVE-2020-2933 →CVE-2020-10683 →

📋 Description

CVE-2019-14900 — hibernate: SQL injection issue in Hibernate ORM CVE-2019-17566 — batik: SSRF via "xlink:href" CVE-2020-1748 — Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain CVE-2020-1945 — ant: insecure temporary file vulnerability CVE-2020-1954 — cxf: JMX integration is vulnerable to a MITM attack CVE-2020-2875 — mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete CVE-2020-2933 — mysql-connector-java: allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized partial DoS CVE-2020-2934 — mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete CVE-2020-10683 — dom4j: XML External Entity vulnerability in default SAX parser CVE-2020-10693 — hibernate-validator: Improper input validation in the interpolation of constraint error messages CVE-2020-10714 — wildfly-elytron: session fixation when using FORM authentication

🎯 Affected products1

  • RHPAM 7.9.0

✅ Remediation

For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is no currently known mitigation for this flaw. Workaround: For versions 1.1 to 1.9.14 and 1.10.0 to 1.10.7, set the java.io.tmpdir system property to a private directory-- only readable and writable by the current user-- before running Ant. For versions 1.9.15 and 1.10.8, use the Ant property ant.tmpfile instead. Ant 1.10.8 protects the temporary files if the underlying filesystem allows it, but using a private temporary directory is still recommended. Workaround: You can pass user input as an expression variable by unwrapping the context to HibernateConstraintValidatorContext. Please refer to the https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/ and https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code. Workaround: This attack is dependent on the attacker being able to create a session and the victim accessing the session before the session expires, we do have a 15 minute session timeout by default but the attacker could also keep this alive by say sending in a request every five minutes. The server by default supports session tracking by URL and Cookie, if the web.xml is updated to support COOKIE only the exploit is not possible by sharing the link. ~~~ <session-config> <tracking-mode>URL</tracking-mode> </session-config> ~~~ TO ~~~ <session-config> <tracking-mode>COOKIE</tracking-mode> </session-config> ~~~

🔗 References (16)