Red Hat Security AdvisoryRHSA-2021:3658
Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
Released 2021-09-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
Fixes 10 records
Priority MEDIUM 58
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.22709 · Published 2021-03-10 · Partial fix · 2.3 CWE-20
Priority MEDIUM 50
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.18891 · Published 2021-03-09 · Partial fix · 4.1.60.Final CWE-444
Priority MEDIUM 48
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.10549 · Published 2021-04-13 · Partial fix · 2.7 CWE-20
Priority MEDIUM 40
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.04935 · Published 2021-03-30 · Partial fix · 4.1.61.Final CWE-444
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01774 · Published 2022-08-23 · Partial fix · 2.0.40, 2.2.10 CWE-400
Priority LOW 29
A flaw was found in undertow.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01161 · Published 2022-05-24 · Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362
Priority LOW 28
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02132 · Published 2021-05-26 · Partial fix · 3.0.4 CWE-20
Priority LOW 26
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2021-08-05 · Partial fix · 1.10.14, 1.15.5 +1 CWE-203
Priority LOW 23
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00533 · Published 2021-05-20 · Partial fix · 23.0.2.Final CWE-79
Priority LOW 18
A flaw was found in wildfly-core in all versions.
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00982 · Published 2022-08-26 · Partial fix · 16.0.1.Final, 17.0.0.Beta3 CWE-200
THREATIST.IORead the docs