Red Hat Security AdvisoryRHSA-2023:7637
Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
Released 2023-12-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
Fixes 8 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 45
A flaw was found in XNIO.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03479 · Published 2024-03-22 · Partial fix · 3.8.11.SP1-redhat-00001, 3.1.16-3.SP1_redhat_00001.1.ep7.el7 +24 CWE-400
Priority MEDIUM 43
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02221 · Published 2023-09-29 · Partial fix · 1.11.3 CWE-502
Priority LOW 36
Jetty is a java based web server and servlet engine.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03369 · Published 2023-04-18 · Partial fix · 9.4.51, 10.0.14 +2 CWE-400
Priority LOW 34
An improper initialization vulnerability was found in Galleon.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0072 · Published 2024-02-06 · Partial fix · 2.2.28-1.SP1_redhat_00001.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el8eap +4 CWE-665
Priority LOW 33
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00248 · Published 2023-06-14 · Partial fix · 32.0.0, 32.0.0-android CWE-552
Priority LOW 27
Jetty is a java based web server and servlet engine.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.013 · Published 2023-04-18 · Partial fix · 9.4.51, 10.0.14 +3 CWE-200
Priority LOW 25
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.01311 · Published 2023-07-10 · Partial fix · 2.10, 2.9.3 +1 CWE-22
THREATIST.IORead the docs