Red Hat Security AdvisoryRHSA-2023:4507
Red Hat JBoss Enterprise Application Platform security update
Released 2023-08-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison-1.5.4-1.redhat_00002.1.el9eap, eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el9eap, eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el9eap +5
Fixes 3 records
Priority HIGH 72
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01009 · Published 2023-03-16 · Partial fix · 1.5.4 CWE-674
Priority MEDIUM 44
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02659 · Published 2023-09-27 · Partial fix · 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap +6 CWE-789
Priority LOW 35
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01124 · Published 2023-03-18 · Partial fix · 2.12.6, 2.13.1 CWE-770
