RHSA-2021:2561MediumCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 Security release

Published
June 29, 2021
Last Modified
November 5, 2026

🔗 CVE IDs covered (3)

CVE-2020-25638 →CVE-2021-25122 →CVE-2021-25329 →

📋 Description

CVE-2020-25638 — hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used CVE-2021-25122 — tomcat: Request mix-up with h2c CVE-2021-25329 — tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)

🎯 Affected products48

  • Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-ecj-0:4.12.0-3.redhat_2.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-ecj-0:4.12.0-3.redhat_2.2.el7jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-ecj-0:4.12.0-3.redhat_2.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-ecj-0:4.12.0-3.redhat_2.2.el8jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el7jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el8jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-mod_cluster-tomcat-0:1.4.3-2.Final_redhat_00002.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-mod_cluster-tomcat-0:1.4.3-2.Final_redhat_00002.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-0:9.0.43-11.redhat_00011.1.el7jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-0:9.0.43-11.redhat_00011.1.el8jws.src as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-admin-webapps-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-admin-webapps-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-docs-webapp-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-docs-webapp-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-el-3.0-api-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-el-3.0-api-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-java-jdk11-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-java-jdk8-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-javadoc-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-javadoc-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-jsp-2.3-api-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-jsp-2.3-api-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • jws5-tomcat-lib-0:9.0.43-11.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 7 Server
  • jws5-tomcat-lib-0:9.0.43-11.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.5 for RHEL 8
  • +18 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters. Workaround: Users may configure the PersistenceManager with an appropriate value for sessionAttributeValueClassNameFilter to ensure that only application provided attributes are serialized and deserialized. For more details about the configuration, refer to the Apache Tomcat 9 Configuration Reference https://tomcat.apache.org/tomcat-9.0-doc/config/manager.html.

🔗 References (6)