RedHat: RHSA-2020-2563:01 Important: EAP Continuous Delivery Technical
Summary
Red Hat JBoss Enterprise Application Platform CD14 is a platform for Java
applications based on the WildFly application runtime.
This release of Red Hat JBoss Enterprise Application Platform CD14 includes
bug fixes and enhancements.
Security Fix(es):
* XML Frameworks: JBoss: JAXP in EAP 7.0 allows RCE via XSL (CVE-2017-7465)
* XML Frameworks: TransformerFactory in JBoss EAP 7 is vulnerable to XXE
(CVE-2017-7503)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
You must restart the JBoss server process for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update)
References
https://access.redhat.com/security/cve/CVE-2017-7465 https://access.redhat.com/security/cve/CVE-2017-7503 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=eap-cd&version=14
Package List
Topic
This is a security update for JBoss EAP Continuous Delivery 14.0.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1439980 - CVE-2017-7465 JBoss: JAXP in EAP 7.0 allows RCE via XSL
1451960 - CVE-2017-7503 EAP: XXE issue in TransformerFactory
