Red Hat Security Advisory

RHSA-2017:0244

Red Hat JBoss Enterprise Application Platform security update

Released 2017-02-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-5.SP4_redhat_1.1.ep6.el6, hornetq-2.3.25-18.SP16_redhat_1.1.ep6.el6, infinispan-5.2.20-1.Final_redhat_1.1.ep6.el6 +47

Fixes 4 records

TI-2016-05857 CVE-2016-6816 · GHSA-jc7p-5r39-9477

Improper input validation in Apache Tomcat

MEDIUM 59

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters.

CVSS 3.0HIGH 7.1 Network No auth User interaction EPSS 0.39633 Published 2017-03-20 Partial fix · 9.0.0.M12, 8.5.8 +3 CWE-20

TI-2016-07118 CVE-2016-8656 · GHSA-v2jx-53jj-4vjf

Improper access control in jbossas

LOW 34

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00346 Published 2018-05-22 Partial fix CWE-284

TI-2016-07089 CVE-2016-8627 · GHSA-wmq3-659r-46hg

Uncontrolled resource consumption in [UNKNOWN] admin-cli

LOW 34

admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02556 Published 2018-05-11 Fixed CWE-400

TI-2016-06068 CVE-2016-7061 · GHSA-35gg-hfjv-3g6c

Information disclosure in Red Hat EAP

LOW 32

An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01766 Published 2018-09-10 Fixed CWE-200