Red Hat Security Advisory

RHSA-2024:3563

Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Released 2024-06-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform org.apache.cxf.cxf-core-3.5.8.redhat-00001.jar, org.jboss.hal.hal-console-3.3.22.Final-redhat-00001-resources.jar, org.wildfly.security.wildfly-elytron-1.15.23.Final-redhat-00001.jar

Fixes 3 records

TI-2021-06136 CVE-2021-23445 · GHSA-h73q-5wmj-q8pj

Cross-site scripting (XSS) in datatables.net

MEDIUM 60

This affects the package datatables.net before 1.11.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01975 Published 2021-09-27 Partial fix · 1.11.3 CWE-79

TI-2024-18986 CVE-2024-28752 · GHSA-qmgx-j96g-4428

Apache CXF SSRF Vulnerability using the Aegis databinding

MEDIUM 47

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.02925 Published 2024-03-15 Partial fix · 4.0.4, 3.6.3 +1 CWE-918

TI-2024-01147 CVE-2024-1233 · GHSA-v4mm-q8fv-r2w5

Eap: wildfly-elytron has a ssrf security issue

MEDIUM 40

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00847 Published 2024-04-09 Partial fix · 32.0.0.Final, 1.15.23.Final-redhat-00001 +57 CWE-918