Red Hat Security AdvisoryRHSA-2017:1411
JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 7
Released 2017-06-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-17.SP20_redhat_1.1.ep7.el7 +47
Fixes 4 records
Priority MEDIUM 44
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy…
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.0597 · Published 2018-03-09 · Partial fix · 3.1.2.Final CWE-20
Priority LOW 39
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03616 · Published 2018-07-27 · Partial fix · 1.3.28 CWE-835
Priority LOW 39
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.
CVSS 3.0HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.03064 · Published 2018-07-27 · Partial fix CWE-22
Priority LOW 34
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.03095 · Published 2018-07-27 · Partial fix · 1.3.31, 1.4.17 CWE-444
THREATIST.IORead the docs