Red Hat Security Advisory

RHSA-2021:2694

Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update

Released 2021-07-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el8eap +47

Fixes 2 records

TI-2021-04507 CVE-2021-21409 · GHSA-f256-j965-7f32

Possible request smuggling in HTTP/2 due missing validation of content-length

MEDIUM 40

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.04935 Published 2021-03-30 Partial fix · 4.1.61.Final CWE-444

TI-2021-02490 CVE-2021-3536 · GHSA-v2wx-jj66-2hp7

Cross-site scripting in wildfly

LOW 23

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00533 Published 2021-05-20 Partial fix · 23.0.2.Final CWE-79