Read the docs
Red Hat Security Advisory

RHSA-2023:5486

Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9

Released 2023-10-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2023-11360 CVE-2023-26136 · GHSA-72xf-g2v4-qvf3

Prototype pollution in tough-cookie

Priority HIGH 81

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02627 Published 2023-07-01 Partial fix · 4.1.3 CWE-1321
TI-2022-09442 CVE-2022-25883 · GHSA-c2qf-rxjj-qqgw

Regular expression denial of service in semver

Priority HIGH 72

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02761 Published 2023-06-21 Partial fix · 7.5.2, 6.3.1 +1 CWE-1333
TI-2023-11611 CVE-2023-26464 · GHSA-vp98-w2p3-mv35

Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

Priority MEDIUM 43

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01905 Published 2023-03-10 Partial fix · 2, 2.0 CWE-502
TI-2023-02971 CVE-2023-3171 · GHSA-gpgq-5q34-mh72

Eap-7: heap exhaustion via deserialization

Priority LOW 35

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01033 Published 2023-12-27 Fixed in 2.16.0-15.redhat_00049.1.el8eap, 1.76.0-4.redhat_00001.1.el8eap +43 CWE-789
TI-2023-17287 CVE-2023-34462 · GHSA-6mjq-h674-j845

netty-handler SniHandler 16MB allocation

Priority LOW 34

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02459 Published 2023-06-22 Partial fix · 4.1.94.Final CWE-400