Red Hat Security Advisory

RHSA-2024:0714

Red Hat JBoss Enterprise Application Platform 7.4.15 Security update

Released 2024-02-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform org.apache.santuario.xmlsec-2.2.6.redhat-00002.jar, org.eclipse.jgit.org.eclipse.jgit-5.13.2.SP1-redhat-00001.jar

Fixes 2 records

TI-2023-04387 CVE-2023-4759 · GHSA-3p86-9955-h393

Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

MEDIUM 44

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02194 Published 2023-09-12 Partial fix · 5.13.3.202401111512-r, 6.6.1.202309021850-r +1 CWE-178

TI-2023-23977 CVE-2023-44483 · GHSA-xfrj-6vvc-3xm2

Apache Santuario: Private Key disclosure in debug-log output

LOW 32

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML S…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01547 Published 2023-10-20 Partial fix · 2.2.6, 2.3.4 +1 CWE-532