Red Hat Security Advisory

RHSA-2022:6822

Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Released 2022-10-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-snakeyaml-1.31.0-1.redhat_00001.1.el8eap, eap7-undertow-2.2.19-1.SP2_redhat_00001.1.el8eap

Fixes 3 records

TI-2022-09423 CVE-2022-25857 · GHSA-3mc7-4q67-w48m

Denial of service (DoS) in org.yaml:snakeyaml

LOW 38

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02932 Published 2022-08-30 Partial fix · 1.31 CWE-776

TI-2022-01145 CVE-2022-1259 · GHSA-5837-3xvj-5g8r

Uncontrolled resource consumption in undertow

LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2022-08-31 Partial fix CWE-400

TI-2022-01901 CVE-2022-2053 · GHSA-95rf-557x-44g5

Uncontrolled resource consumption in Undertow

LOW 35

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01093 Published 2022-08-05 Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400