rhsa-2020_2061
Vulnerability from csaf_redhat
Published
2020-05-11 20:19
Modified
2024-11-05 22:12
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.2.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* cxf: reflected XSS in the services listing page (CVE-2019-17573)
* smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader (CVE-2020-1729)
* jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)
* wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)
* undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)
* cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)
* cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)
* undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could result in security bypass (CVE-2020-1757)
* wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain (CVE-2020-1719)
* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)
* undertow: Memory exhaustion issue in HttpReadListener via "Expect:
100-continue" header (CVE-2020-10705)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* cxf: reflected XSS in the services listing page (CVE-2019-17573)\n\n* smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader (CVE-2020-1729)\n\n* jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)\n\n* wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)\n\n* undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)\n\n* cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)\n\n* cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)\n\n* undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could result in security bypass (CVE-2020-1757)\n\n* wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain (CVE-2020-1719)\n\n* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)\n\n* undertow: Memory exhaustion issue in HttpReadListener via \"Expect:\n100-continue\" header (CVE-2020-10705)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2061",
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=7.2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=7.2"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/"
},
{
"category": "external",
"summary": "1715075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1715075"
},
{
"category": "external",
"summary": "1752770",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752770"
},
{
"category": "external",
"summary": "1796617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796617"
},
{
"category": "external",
"summary": "1797006",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797006"
},
{
"category": "external",
"summary": "1797011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797011"
},
{
"category": "external",
"summary": "1801380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801380"
},
{
"category": "external",
"summary": "1801726",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801726"
},
{
"category": "external",
"summary": "1802444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802444"
},
{
"category": "external",
"summary": "1803241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803241"
},
{
"category": "external",
"summary": "1807305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807305"
},
{
"category": "external",
"summary": "1828459",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459"
},
{
"category": "external",
"summary": "JBEAP-18071",
"url": "https://issues.redhat.com/browse/JBEAP-18071"
},
{
"category": "external",
"summary": "JBEAP-18267",
"url": "https://issues.redhat.com/browse/JBEAP-18267"
},
{
"category": "external",
"summary": "JBEAP-18278",
"url": "https://issues.redhat.com/browse/JBEAP-18278"
},
{
"category": "external",
"summary": "JBEAP-18423",
"url": "https://issues.redhat.com/browse/JBEAP-18423"
},
{
"category": "external",
"summary": "JBEAP-18438",
"url": "https://issues.redhat.com/browse/JBEAP-18438"
},
{
"category": "external",
"summary": "JBEAP-18503",
"url": "https://issues.redhat.com/browse/JBEAP-18503"
},
{
"category": "external",
"summary": "JBEAP-18506",
"url": "https://issues.redhat.com/browse/JBEAP-18506"
},
{
"category": "external",
"summary": "JBEAP-18536",
"url": "https://issues.redhat.com/browse/JBEAP-18536"
},
{
"category": "external",
"summary": "JBEAP-18595",
"url": "https://issues.redhat.com/browse/JBEAP-18595"
},
{
"category": "external",
"summary": "JBEAP-18616",
"url": "https://issues.redhat.com/browse/JBEAP-18616"
},
{
"category": "external",
"summary": "JBEAP-18628",
"url": "https://issues.redhat.com/browse/JBEAP-18628"
},
{
"category": "external",
"summary": "JBEAP-18631",
"url": "https://issues.redhat.com/browse/JBEAP-18631"
},
{
"category": "external",
"summary": "JBEAP-18639",
"url": "https://issues.redhat.com/browse/JBEAP-18639"
},
{
"category": "external",
"summary": "JBEAP-18646",
"url": "https://issues.redhat.com/browse/JBEAP-18646"
},
{
"category": "external",
"summary": "JBEAP-18652",
"url": "https://issues.redhat.com/browse/JBEAP-18652"
},
{
"category": "external",
"summary": "JBEAP-18664",
"url": "https://issues.redhat.com/browse/JBEAP-18664"
},
{
"category": "external",
"summary": "JBEAP-18724",
"url": "https://issues.redhat.com/browse/JBEAP-18724"
},
{
"category": "external",
"summary": "JBEAP-18729",
"url": "https://issues.redhat.com/browse/JBEAP-18729"
},
{
"category": "external",
"summary": "JBEAP-18787",
"url": "https://issues.redhat.com/browse/JBEAP-18787"
},
{
"category": "external",
"summary": "JBEAP-18789",
"url": "https://issues.redhat.com/browse/JBEAP-18789"
},
{
"category": "external",
"summary": "JBEAP-18817",
"url": "https://issues.redhat.com/browse/JBEAP-18817"
},
{
"category": "external",
"summary": "JBEAP-18827",
"url": "https://issues.redhat.com/browse/JBEAP-18827"
},
{
"category": "external",
"summary": "JBEAP-18835",
"url": "https://issues.redhat.com/browse/JBEAP-18835"
},
{
"category": "external",
"summary": "JBEAP-18931",
"url": "https://issues.redhat.com/browse/JBEAP-18931"
},
{
"category": "external",
"summary": "JBEAP-18988",
"url": "https://issues.redhat.com/browse/JBEAP-18988"
},
{
"category": "external",
"summary": "JBEAP-18989",
"url": "https://issues.redhat.com/browse/JBEAP-18989"
},
{
"category": "external",
"summary": "JBEAP-19233",
"url": "https://issues.redhat.com/browse/JBEAP-19233"
},
{
"category": "external",
"summary": "JBEAP-19234",
"url": "https://issues.redhat.com/browse/JBEAP-19234"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2061.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 security update",
"tracking": {
"current_release_date": "2024-11-05T22:12:32+00:00",
"generator": {
"date": "2024-11-05T22:12:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2020:2061",
"initial_release_date": "2020-05-11T20:19:28+00:00",
"revision_history": [
{
"date": "2020-05-11T20:19:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-05-11T20:19:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T22:12:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss EAP 7.2",
"product": {
"name": "Red Hat JBoss EAP 7.2",
"product_id": "Red Hat JBoss EAP 7.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Brian Stansberry"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2019-10172",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2019-04-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1715075"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity (XXE) vulnerability affects codehaus\u0027s jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-mapper-asl: XML external entity similar to CVE-2016-3720",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10172"
},
{
"category": "external",
"summary": "RHBZ#1715075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1715075"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10172",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10172"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10172",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10172"
}
],
"release_date": "2019-11-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-mapper-asl: XML external entity similar to CVE-2016-3720"
},
{
"cve": "CVE-2019-12423",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2020-01-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1797006"
}
],
"notes": [
{
"category": "description",
"text": "Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter \"rs.security.keystore.type\" to \"jwk\". For this case all keys are returned in this file \"as is\", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. \"oct\" keys, which contain secret keys, are not returned at all.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cxf: OpenId Connect token service does not properly validate the clientId",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-12423"
},
{
"category": "external",
"summary": "RHBZ#1797006",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797006"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-12423",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12423"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12423",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12423"
}
],
"release_date": "2020-01-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cxf: OpenId Connect token service does not properly validate the clientId"
},
{
"cve": "CVE-2019-17573",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-01-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1797011"
}
],
"notes": [
{
"category": "description",
"text": "By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cxf: reflected XSS in the services listing page",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17573"
},
{
"category": "external",
"summary": "RHBZ#1797011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17573",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17573"
}
],
"release_date": "2020-01-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
},
{
"category": "workaround",
"details": "Mitigate this flaw by disabling the service listing altogether; via setting the \"hide-service-list-page\" servlet parameter to \"true\".",
"product_ids": [
"Red Hat JBoss EAP 7.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cxf: reflected XSS in the services listing page"
},
{
"cve": "CVE-2020-1719",
"cwe": {
"id": "CWE-270",
"name": "Privilege Context Switching Error"
},
"discovery_date": "2019-08-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1796617"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1719"
},
{
"category": "external",
"summary": "RHBZ#1796617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1719",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1719"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1719",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1719"
}
],
"release_date": "2019-06-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain"
},
{
"acknowledgments": [
{
"names": [
"Darran Lofthouse"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2020-1729",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2019-09-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802444"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SmallRye\u0027s API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1729"
},
{
"category": "external",
"summary": "RHBZ#1802444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802444"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1729",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1729"
}
],
"release_date": "2020-02-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader"
},
{
"cve": "CVE-2020-1732",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2020-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1801726"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly where multiple requests occurring concurrently could be handled using the identity of another request. This vulnerability occurs when using EE Security with WildFly Elytron. The largest threat from this vulnerability is data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Soteria: security identity corruption across concurrent threads",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1732"
},
{
"category": "external",
"summary": "RHBZ#1801726",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801726"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1732",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1732"
}
],
"release_date": "2020-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Soteria: security identity corruption across concurrent threads"
},
{
"acknowledgments": [
{
"names": [
"Steve Zapantis",
"Robert Roberson",
"taktakdb4g"
]
}
],
"cve": "CVE-2020-1745",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2020-02-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1807305"
}
],
"notes": [
{
"category": "description",
"text": "A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: AJP File Read/Inclusion Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251 and CVE page https://access.redhat.com/security/cve/cve-2020-1938",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1745"
},
{
"category": "external",
"summary": "RHBZ#1807305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807305"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1745",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1745"
},
{
"category": "external",
"summary": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/",
"url": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/"
},
{
"category": "external",
"summary": "https://www.cnvd.org.cn/webinfo/show/5415",
"url": "https://www.cnvd.org.cn/webinfo/show/5415"
},
{
"category": "external",
"summary": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487",
"url": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487"
}
],
"release_date": "2020-02-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
},
{
"category": "workaround",
"details": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251",
"product_ids": [
"Red Hat JBoss EAP 7.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow: AJP File Read/Inclusion Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Fedorov Oleksii",
"Keitaro Yamazaki",
"Shiga Ryota"
],
"organization": "LINE Corporation"
}
],
"cve": "CVE-2020-1757",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2019-09-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1752770"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1757"
},
{
"category": "external",
"summary": "RHBZ#1752770",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752770"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1757",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1757"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1757",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1757"
}
],
"release_date": "2018-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
},
{
"category": "workaround",
"details": "The issue can be mitigated by configuring UrlPathHelper to ignore the servletPath via setting \"alwaysUseFullPath\".",
"product_ids": [
"Red Hat JBoss EAP 7.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass"
},
{
"cve": "CVE-2020-7226",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2020-02-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1801380"
}
],
"notes": [
{
"category": "description",
"text": "CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with \"new byte\" may depend on untrusted input within the header of encoded data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptacular: excessive memory allocation during a decode operation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7226"
},
{
"category": "external",
"summary": "RHBZ#1801380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801380"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7226",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7226"
}
],
"release_date": "2020-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cryptacular: excessive memory allocation during a decode operation"
},
{
"cve": "CVE-2020-10705",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1803241"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Undertow where certain requests to the \"Expect: 100-continue\" header may cause an out of memory error. This flaw may potentially lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: Memory exhaustion issue in HttpReadListener via \"Expect: 100-continue\" header",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10705"
},
{
"category": "external",
"summary": "RHBZ#1803241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803241"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10705",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10705"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10705",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10705"
}
],
"release_date": "2020-05-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
},
{
"category": "workaround",
"details": "There is currently no known mitigation for this security flaw.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow: Memory exhaustion issue in HttpReadListener via \"Expect: 100-continue\" header"
},
{
"acknowledgments": [
{
"names": [
"ZeddYu"
]
}
],
"cve": "CVE-2020-10719",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2020-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1828459"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: invalid HTTP request with large chunk size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss EAP 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10719"
},
{
"category": "external",
"summary": "RHBZ#1828459",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10719",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10719"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719"
}
],
"release_date": "2020-05-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-11T20:19:28+00:00",
"details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
"product_ids": [
"Red Hat JBoss EAP 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2061"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss EAP 7.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undertow: invalid HTTP request with large chunk size"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.