Red Hat Security Advisory

RHSA-2024:8080

Red Hat JBoss Enterprise Application Platform 7.4.19 Security update

Released 2024-10-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.33.SP2-redhat-00001.jar, org.bitbucket.b_c.jose4j-0.9.3.redhat-00002.pom, org.jsoup.jsoup-1.15.4.redhat-00003.jar +2

TI-2022-15084 CVE-2022-34169 · GHSA-9339-86wc-4qgf

HIGH 79

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.81759 Published 2022-07-19 Partial fix · 2.7.3 CWE-681

TI-2023-28403 CVE-2023-51775 · GHSA-6qvw-249j-h44c

MEDIUM 62

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00871 Published 2023-12-25 Partial fix · 0.9.4 CWE-400

TI-2022-16458 CVE-2022-36033 · GHSA-gp7f-rwcx-9369

MEDIUM 60

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01643 Published 2022-08-29 Partial fix · 1.15.3 CWE-79

TI-2024-07308 CVE-2024-7885 · GHSA-9623-mqmm-5rcf

LOW 38

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02644 Published 2024-08-21 Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362

TI-2024-03758 CVE-2024-4029 · GHSA-x7g6-rwhc-g7mj

LOW 19

A vulnerability was found in Wildfly’s management interface.

CVSS 3.1MEDIUM 4.1 Local High privileges No interaction EPSS 0.00277 Published 2024-05-02 Partial fix · 24.0.1.Final, 25.0.0.Final +102 CWE-770