Red Hat Security Advisory

RHSA-2024:5482

Red Hat JBoss Enterprise Application Platform 8.0.3 Security update

Released 2024-08-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 8

Fixes 6 records

TI-2024-19434 CVE-2024-29371 · GHSA-3677-xxcr-wjqv

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by…

HIGH 72

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00257 Published 2025-12-17 Partial fix · 0.9.6 CWE-1259

TI-2024-19207 CVE-2024-29025 · GHSA-5jpm-x58v-624v

Netty HttpPostRequestDecoder can OOM

MEDIUM 63

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0138 Published 2024-03-25 Partial fix · 4.1.108.Final CWE-770

TI-2024-18986 CVE-2024-28752 · GHSA-qmgx-j96g-4428

Apache CXF SSRF Vulnerability using the Aegis databinding

MEDIUM 47

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.02925 Published 2024-03-15 Partial fix · 4.0.4, 3.6.3 +1 CWE-918

TI-2024-19629 CVE-2024-29857 · GHSA-8xfc-gm6g-vgpv

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)…

LOW 35

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.011 Published 2024-05-09 Partial fix · 1.78, 1.0.2.5 +1 CWE-125

TI-2024-19921 CVE-2024-30172 · GHSA-m44j-cfrm-g8qc

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.

LOW 34

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2024-05-09 Partial fix · 1.78, 2.3.1 CWE-835

TI-2024-19920 CVE-2024-30171 · GHSA-v435-xc8x-wvr9

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.

LOW 28

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00901 Published 2024-05-09 Partial fix · 1.0.19, 1.78 +1 CWE-203