Red Hat Security Advisory

RHSA-2022:7273

Red Hat JBoss Web Server 5.7.0 release and security update

Released 2022-11-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

JWS 5.7.0

Fixes 4 records

TI-2021-10870 CVE-2021-30468 · GHSA-g23v-p5jq-jvh4

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

MEDIUM 43

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07024 Published 2021-06-16 Partial fix · 3.4.4, 3.3.11 CWE-400

TI-2021-05579 CVE-2021-22696 · GHSA-7q4h-pj78-j7vg

OAuth 2 authorization service vulnerable to DDos attacks

MEDIUM 42

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06593 Published 2021-04-02 Partial fix · 3.4.3, 3.3.10 CWE-400

TI-2022-07334 CVE-2022-23181 · GHSA-9f3j-pm6f-9fm5

Local privilege escalation with FileStore

LOW 32

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00692 Published 2022-01-27 Partial fix · 10.0.16, 9.0.58 +1 CWE-367

TI-2021-19736 CVE-2021-43980 · GHSA-jx7c-7mj5-9438

Apache Tomcat: Information disclosure

LOW 22

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.02362 Published 2022-09-28 Partial fix · 8.5.78, 9.0.62 +2 CWE-362