Red Hat Security AdvisoryRHSA-2023:4509
Red Hat JBoss Enterprise Application Platform 7.4.12 security update
Released 2023-08-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, io.undertow.undertow-core-2.2.25.SP3-redhat-00001.jar, org.codehaus.jettison.jettison-1.5.4.redhat-00002.jar
Fixes 3 records
Priority HIGH 72
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01009 · Published 2023-03-16 · Partial fix · 1.5.4 CWE-674
Priority MEDIUM 44
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02659 · Published 2023-09-27 · Partial fix · 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap +6 CWE-789
Priority LOW 35
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01124 · Published 2023-03-18 · Partial fix · 2.12.6, 2.13.1 CWE-770
