Red Hat Security AdvisoryRHSA-2023:0163
Red Hat JBoss Enterprise Application Platform 7.4 security update
Released 2023-01-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf-3.4.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.redhat_00001.1.el7eap +1
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf-3.4.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.4.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.4.10-1.redhat_00001.1.el8eap +1
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf-3.4.10-1.redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.4.10-1.redhat_00001.1.el9eap, eap7-apache-cxf-services-3.4.10-1.redhat_00001.1.el9eap +1
Fixes 1 record
Priority MEDIUM 53
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02315 · Published 2022-12-13 · Partial fix · 3.5.5, 3.4.10 CWE-918
