Red Hat Security Advisory

RHSA-2024:0711

Red Hat JBoss Enterprise Application Platform 7.4.15 Security update

Released 2024-02-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-eclipse-jgit-5.13.2-1.SP1_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.14-7.SP08_redhat_00001.1.el8eap, eap7-hibernate-5.3.33-2.Final_redhat_00001.1.el8eap +47

Fixes 2 records

TI-2023-04387 CVE-2023-4759 · GHSA-3p86-9955-h393

Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

MEDIUM 44

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02194 Published 2023-09-12 Partial fix · 5.13.3.202401111512-r, 6.6.1.202309021850-r +1 CWE-178

TI-2023-23977 CVE-2023-44483 · GHSA-xfrj-6vvc-3xm2

Apache Santuario: Private Key disclosure in debug-log output

LOW 32

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML S…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01547 Published 2023-10-20 Partial fix · 2.2.6, 2.3.4 +1 CWE-532