Red Hat Security Advisory

RHSA-2024:2764

Red Hat JBoss Enterprise Application Platform 8.0 security update

Released 2024-05-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 8.0 for RHEL 8 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el8eap
Red Hat JBoss EAP 8.0 for RHEL 9 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el9eap

Fixes 3 records

TI-2023-01856 CVE-2023-1973 · GHSA-97cq-f4jm-mv8h

Undertow: unrestricted request storage leads to memory exhaustion

MEDIUM 41

A flaw was found in Undertow package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01284 Published 2024-11-07 Fixed in 2.2.30-1.SP1_redhat_00001.1.el8eap, 2.2.30-1.SP1_redhat_00001.1.el9eap +5 CWE-20

TI-2023-04276 CVE-2023-4639 · GHSA-3jrv-jgp8-45v3

Undertow: cookie smuggling/spoofing

LOW 37

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01093 Published 2024-11-17 Partial fix · 1.2-23, 1.2-15 +9 CWE-444

TI-2024-01362 CVE-2024-1459 · GHSA-v76w-3ph8-vm66

Undertow: directory traversal vulnerability

LOW 27

A path traversal vulnerability was found in Undertow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01714 Published 2024-02-12 Partial fix · 2.3.12, 2.16.0-18.redhat_00052.1.el8eap +57 CWE-24