Red Hat Security AdvisoryRHSA-2020:2565
EAP Continuous Delivery Technical Preview Release 18 security update
Released 2020-06-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform Continuous Delivery
Fixes 9 records
Priority HIGH 75
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.87286 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.82813 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.83433 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 67
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.59547 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 52
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.05733 · Published 2020-04-07 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 50
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.03683 · Published 2020-04-07 · Partial fix · 2.9.10.4 CWE-502
Priority LOW 36
A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0163 · Published 2021-03-23 · Partial fix CWE-400
Priority LOW 25
A flaw was found in wildfly-core before 7.2.5.GA.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01141 · Published 2019-10-14 · Partial fix · 7.2.5.GA CWE-284
Priority LOW 21
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system.
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.0019 · Published 2019-05-03 · Partial fix CWE-364
THREATIST.IORead the docs