THREATIST.IORead the docs Red Hat JBoss Enterprise Application Platform security update
Released 2017-06-07 · Red Hat rating Moderate · View on Red Hat →
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy…
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.