Red Hat Security Advisory

RHSA-2024:5147

Red Hat JBoss Enterprise Application Platform 7.4.18 Security update

Released 2024-08-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.33.SP1-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.78.1.redhat-00002.pom

Fixes 7 records

TI-2024-18154 CVE-2024-27316 · GHSA-5qc4-82jh-h385

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HIGH 81

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.88755 Published 2024-04-04 Partial fix CWE-770

TI-2024-19207 CVE-2024-29025 · GHSA-5jpm-x58v-624v

Netty HttpPostRequestDecoder can OOM

MEDIUM 63

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0138 Published 2024-03-25 Partial fix · 4.1.108.Final CWE-770

TI-2024-05534 CVE-2024-5971 · GHSA-xpp6-8r3j-ww43

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

MEDIUM 44

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02921 Published 2024-07-08 Partial fix · 2.2.34.Final, 2.3.15.Final +4 CWE-674

TI-2024-19629 CVE-2024-29857 · GHSA-8xfc-gm6g-vgpv

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)…

LOW 35

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.011 Published 2024-05-09 Partial fix · 1.78, 1.0.2.5 +1 CWE-125

TI-2024-19921 CVE-2024-30172 · GHSA-m44j-cfrm-g8qc

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.

LOW 34

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2024-05-09 Partial fix · 1.78, 2.3.1 CWE-835

TI-2024-03408 CVE-2024-3653 · GHSA-ch7q-gpff-h9hp

Undertow: learningpushhandler can lead to remote memory dos attacks

LOW 34

A vulnerability was found in Undertow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01866 Published 2024-07-08 Partial fix · 5.2.4.redhat-00001, 2.2.33.SP1-redhat-00001 +5 CWE-401

TI-2024-19920 CVE-2024-30171 · GHSA-v435-xc8x-wvr9

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.

LOW 28

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00901 Published 2024-05-09 Partial fix · 1.0.19, 1.78 +1 CWE-203