Red Hat Security Advisory

RHSA-2019:1159

Red Hat JBoss Enterprise Application Platform 6.4.22 security update

Released 2019-05-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-8.SP7_redhat_1.1.ep6.el5, dom4j-eap6-1.6.1-22.redhat_9.1.ep6.el5, hornetq-2.3.25-28.SP29_redhat_1.1.ep6.el5 +47

TI-2018-05811 CVE-2018-8034 · GHSA-46j3-r4pj-4835

MEDIUM 58

The host name verification when using TLS with the WebSocket client was missing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.21048 Published 2018-08-01 Partial fix · 9.0.10, 8.5.32 +2 CWE-295

TI-2018-15986 CVE-2018-1000632 · GHSA-6pcc-3rfx-4gpm

MEDIUM 42

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0657 Published 2018-08-20 Partial fix · 2.0.3, 2.1.1 CWE-91

TI-2018-07746 CVE-2018-10934 · GHSA-fw7x-p3x6-x9p7

LOW 26

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00947 Published 2019-03-27 Partial fix CWE-79