Red Hat Security Advisory

RHSA-2019:1424

Red Hat JBoss Enterprise Application Platform 7.2.2 security update

Released 2019-06-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2019-02898 CVE-2019-3888 · GHSA-jwgx-9mmh-684w

MEDIUM 48

A vulnerability was found in Undertow web server before 2.0.21.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03028 Published 2019-06-12 Partial fix · 2.0.21 CWE-532

TI-2019-02883 CVE-2019-3873 · GHSA-59jq-66fv-jgww

MEDIUM 41

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML.

CVSS 3.0CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0091 Published 2019-06-12 Fixed CWE-79

TI-2019-02882 CVE-2019-3872 · GHSA-5qcq-825g-ghpg

LOW 26

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00685 Published 2019-06-12 Fixed CWE-79