Red Hat Security Advisory

RHSA-2024:8076

Red Hat JBoss Enterprise Application Platform 7.4.19 Security update

Released 2024-10-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console-3.3.24-1.Final_redhat_00001.1.el8eap, eap7-hibernate-validator-6.0.23-2.SP1_redhat_00001.1.el8eap, eap7-hibernate-validator-cdi-6.0.23-2.SP1_redhat_00001.1.el8eap +25

TI-2022-15084 CVE-2022-34169 · GHSA-9339-86wc-4qgf

HIGH 79

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.81759 Published 2022-07-19 Partial fix · 2.7.3 CWE-681

TI-2023-28403 CVE-2023-51775 · GHSA-6qvw-249j-h44c

MEDIUM 62

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00871 Published 2023-12-25 Partial fix · 0.9.4 CWE-400

TI-2022-16458 CVE-2022-36033 · GHSA-gp7f-rwcx-9369

MEDIUM 60

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01643 Published 2022-08-29 Partial fix · 1.15.3 CWE-79

TI-2024-03788 CVE-2024-4068 · GHSA-grv7-fg5c-xmjg

MEDIUM 42

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01471 Published 2024-05-13 Partial fix · 3.0.3 CWE-1050

TI-2024-03758 CVE-2024-4029 · GHSA-x7g6-rwhc-g7mj

LOW 19

A vulnerability was found in Wildfly’s management interface.

CVSS 3.1MEDIUM 4.1 Local High privileges No interaction EPSS 0.00277 Published 2024-05-02 Partial fix · 24.0.1.Final, 25.0.0.Final +102 CWE-770