RHSA-2020:5361HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Thorntail 2.7.2 security and bug fix update

Published
December 16, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2020-14299 →CVE-2020-14338 →CVE-2020-14340 →CVE-2020-25638 →CVE-2020-25649 →

📋 Description

CVE-2020-14299 — picketbox: JBoss EAP reload to admin-only mode allows authentication bypass CVE-2020-14338 — wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl CVE-2020-14340 — xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS CVE-2020-25638 — hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

🎯 Affected products1

  • Text-Only RHOAR

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters. Workaround: There is currently no known mitigation for this flaw.

🔗 References (10)