Red Hat Security Advisory

RHSA-2020:3144

Red Hat JBoss Enterprise Application Platform 7.2 security update

Released 2020-07-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.2

Fixes 3 records

TI-2020-08639 CVE-2020-10740 · GHSA-vrmw-2xhq-hrmp

Deserialization of untrusted data in [UNKNOWN] wildfly

LOW 37

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.02067 Published 2020-06-22 Partial fix · 20.0.0.Final CWE-502

TI-2020-11178 CVE-2020-14307 · GHSA-q562-x7c7-5fc9

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with…

LOW 31

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01203 Published 2020-07-24 Partial fix CWE-404

TI-2020-11168 CVE-2020-14297 · GHSA-qcch-9268-59jw

Uncontrolled resource consumption in Red Hat wildfly

LOW 31

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavaila…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01203 Published 2020-07-24 Partial fix · 4.0.34.Final CWE-400