Red Hat Security Advisory

RHSA-2021:3471

Red Hat JBoss Enterprise Application Platform 7.3.9 security update

Released 2021-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

EAP 7.3.9 release

Fixes 5 records

TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20

TI-2021-02626 CVE-2021-3690 · GHSA-fj7c-vg2v-ccrm

Uncontrolled resource consumption in undertow

LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01774 Published 2022-08-23 Partial fix · 2.0.40, 2.2.10 CWE-400

TI-2021-02544 CVE-2021-3597 · GHSA-mfhv-gwf8-4m88

Race condition in undertow

LOW 29

A flaw was found in undertow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01161 Published 2022-05-24 Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362

TI-2021-09399 CVE-2021-28170 · GHSA-v6w3-2prq-h95f

Improper input validation in Eclipse Foundation Jakarta Expression Language Implementation

LOW 28

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02132 Published 2021-05-26 Partial fix · 3.0.4 CWE-20

TI-2021-02589 CVE-2021-3644 · GHSA-w88m-2936-rmxr

Information disclosure in wildfly-core

LOW 18

A flaw was found in wildfly-core in all versions.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00982 Published 2022-08-26 Partial fix · 16.0.1.Final, 17.0.0.Beta3 CWE-200