N/A - RHSA-2020:0556

Executive Summary

Summary
Title	Open Liberty 20.0.0.2 Runtime security update

Informations
Name	RHSA-2020:0556	First vendor Publication	2020-02-19
Vendor	RedHat	Last vendor Modification	2020-02-19
Severity (Vendor)	N/A	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Open Liberty 20.0.0.2 Runtime is now available from the Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Description:

This release of Open Liberty 20.0.0.2 serves as a replacement for Open Liberty 20.0.0.1 and includes security fixes, bug fixes, and enhancements. For specific information about this release, see links in the References section.

Security Fix(es):

* WebSphere Application Server is vulnerable to a denial of service (CVE-2019-4720)

* Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-12406)

For more details about the security issue(s), see the IBM Security Bulletin links for each CVE, listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).

4. JIRA issues fixed (https://issues.jboss.org/):

IBMRT-18 - Include open liberty 20.0.0.2 into RedHat runtimes

5. References:

https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=open.liberty&version=20.0.0.2 https://www.ibm.com/support/pages/security-bulletin-websphere-application-server-vulnerable-denial-service-cve-2019-4720 https://www.ibm.com/support/pages/security-bulletin-vulnerability-apache-cxf-affects-websphere-application-server-cve-2019-12406 https://access.redhat.com/articles/4544981 https://access.redhat.com/documentation/en-us/open_liberty/2020/