[RHSA-2020:4922-01] Important: Red Hat JBoss Enterprise Application Platform 7.3 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 7.3 security update
Advisory ID:       RHSA-2020:4922-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:4922
Issue date:        2020-11-04
CVE Names:         CVE-2020-25644 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss EAP 7.3 for BaseOS-8 - x86_64
Red Hat JBoss EAP 7.3 for RHEL 6 Server - x86_64
Red Hat JBoss EAP 7.3 for RHEL 7 Server - x86_64

3. Description:

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java
applications based on the WildFly application runtime.

This asynchronous patch is a security update for Red Hat JBoss Enterprise
Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Security Fix(es):

* wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL
(CVE-2020-25644)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, see the CVE page(s) listed in the
References section.

4. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1885485 - CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

6. Package List:

Red Hat JBoss EAP 7.3 for RHEL 6 Server:

Source:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el6eap.src.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el6eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.12-1.Final_redhat_00001.1.el6eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for RHEL 7 Server:

Source:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el7eap.src.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el7eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.12-1.Final_redhat_00001.1.el7eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for BaseOS-8:

Source:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el8eap.src.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el8eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.12-1.Final_redhat_00001.1.el8eap.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-25644
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBX6LL29zjgjWX9erEAQjQQw//absY2WPlYeXM2BLNyWPhuCuNwPiosu7r
ezzlmU1LawVdMWJHEBY2YHVFwe9pFkO4JTQmKE0n5nZC8VTCTz4A3ombjZX6vFAr
YSd8qf1BEtHxIDxZTyEVaqFXuhleJSsQstf8UEhtlDLlzpUZMmvtT/LroHNcKdsA
TCk755XV1NgKQyWZN0xzwcF1ym6KDO7mFwN7qtUtBI7v7AGccgnWrDo7UajZiJKi
vERfRWtVviCCmZXNLZaMp44/vwN3lu+I3WJ7Eaaq+mzyutgRd+1EqafMO1D+9j6W
iixfDOeNeOMQNX4Dnt293PSo4JtWD6rr4W5bUq5DBxJUPW1XD64K9Wf1vDqrFog3
zC3s9nS0Qv9LcGNSzdewLNRhLRZkChl8MT0FepOtJzDMyCt1MiYGyHTSyOL+gpXW
OrwsibT6PbPijA1CnYiRilet70HEVIoqpiwrR6+VclcU/4cjiWKcewbp3OgaHx1h
fafNyoe6c3bZOtbUxwM/8G80kXg/jSU++ABBA6PpRt4vRb7aARhSfPWQwkWCjw7Q
uqoa/btvWmtAWNcJ5pyYAYFcImkEdrBJyOZk4CgDiTtxMYObBMdy3JlJLy5pb/UG
/4xlL0KIZQgAyGquROtnp322do9kXy3Gol9abbhmV5UVgO8LAFJWIqd/XLsxi4MA
CbzldXOgJU0=
=PlKV
-----END PGP SIGNATURE-----