RHSA-2020:5342HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update

Published
December 3, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2020-25649 →CVE-2020-25638 →CVE-2020-25644 →

📋 Description

CVE-2020-25638 — hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used CVE-2020-25644 — wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

🎯 Affected products87

  • Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-0:2.9.0-6.redhat_00016.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-cli-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-commons-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-core-client-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-dto-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-hornetq-protocol-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-hqclient-protocol-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-jdbc-store-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-jms-client-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-jms-server-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-journal-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-ra-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-selector-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-server-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-service-extensions-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-activemq-artemis-tools-0:2.9.0-6.redhat_00016.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-fge-btf-0:1.2.0-1.redhat_00007.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-fge-btf-0:1.2.0-1.redhat_00007.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-fge-msg-simple-0:1.1.0-1.redhat_00007.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-fge-msg-simple-0:1.1.0-1.redhat_00007.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-hal-console-0:3.2.11-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-hal-console-0:3.2.11-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-hibernate-validator-0:6.0.21-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-hibernate-validator-0:6.0.21-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-hibernate-validator-cdi-0:6.0.21-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-jackson-annotations-0:2.10.4-1.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-jackson-annotations-0:2.10.4-1.redhat_00002.1.el8eap.src as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • eap7-jackson-core-0:2.10.4-1.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.3 for BaseOS-8
  • +57 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. For details about how to apply this update, see: https://access.redhat.com/articles/11258 Workaround: Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters. Workaround: There is currently no known mitigation for this issue. Workaround: There is currently no known mitigation for this flaw.

🔗 References (20)