RHSA-2021:5154MediumCVSS 7.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update

Published
December 15, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-20289 →CVE-2021-37714 →CVE-2021-40690 →CVE-2021-3629 →CVE-2021-3642 →CVE-2021-3717 →

📋 Description

CVE-2021-3629 — undertow: potential security issue in flow control over HTTP/2 may lead to DOS CVE-2021-3642 — wildfly-elytron: possible timing attack in ScramServer CVE-2021-3717 — wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users CVE-2021-20289 — resteasy: Error message exposes endpoint class information CVE-2021-37714 — jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck CVE-2021-40690 — xml-security: XPath Transform abuse allows for information disclosure

🎯 Affected products1

  • EAP 7.3.10 GA

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update).

🔗 References (20)