Red Hat Security Advisory

RHSA-2024:3580

Red Hat JBoss Enterprise Application Platform 8.0.2 Security update

Released 2024-06-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el8eap +47

Fixes 4 records

TI-2024-01147 CVE-2024-1233 · GHSA-v4mm-q8fv-r2w5

Eap: wildfly-elytron has a ssrf security issue

MEDIUM 40

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00847 Published 2024-04-09 Partial fix · 32.0.0.Final, 1.15.23.Final-redhat-00001 +57 CWE-918

TI-2023-05727 CVE-2023-6236 · GHSA-jpmx-996v-48fm

Eap: oidc app attempting to access the second tenant, the user should be prompted to log

LOW 38

A flaw was found in Red Hat Enterprise Application Platform 8.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00328 Published 2024-04-10 Partial fix · 4.0.1-1.Final_redhat_00001.1.el8eap, 2.2.4-2.SP01_redhat_00001.1.el8eap +3 CWE-345

TI-2023-04156 CVE-2023-4503 · GHSA-6c6r-r3r9-h62j

Eap-galleon: custom provisioning creates unsecured http-invoker

LOW 34

An improper initialization vulnerability was found in Galleon.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0072 Published 2024-02-06 Partial fix · 2.2.28-1.SP1_redhat_00001.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el8eap +4 CWE-665

TI-2024-01021 CVE-2024-1102 · GHSA-9wmf-xf3h-r8pr

Jberet: jberet-core logging database credentials

LOW 30

A vulnerability was found in jberet-core logging.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00808 Published 2024-04-25 Partial fix · 2.2.1, 1.3.9.SP3-redhat-00001 +5 CWE-523