Red Hat Security Advisory: Red Hat Process Automation Manager 7.10.1 security update
🔗 CVE IDs covered (2)
📋 Description
CVE-2020-9488 — log4j: improper validation of certificate with host mismatch in SMTP appender CVE-2020-13956 — apache-httpclient: incorrect handling of malformed authority component in request URIs
🎯 Affected products1
- RHPAM 7.10.1
✅ Remediation
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2021:1044
- externalhttps://access.redhat.com/security/updates/classification/#moderate
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=rhpam&version=7.10.1
- externalhttps://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.10/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1831139
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1886587
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1044.json