Red Hat Security Advisory

RHSA-2024:8823

Red Hat JBoss Enterprise Application Platform 8.0.4 Security update

Released 2024-11-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.33.0-1.redhat_00015.1.el8eap, eap8-activemq-artemis-cli-2.33.0-1.redhat_00015.1.el8eap, eap8-activemq-artemis-commons-2.33.0-1.redhat_00015.1.el8eap +47

Fixes 7 records

TI-2022-15084 CVE-2022-34169 · GHSA-9339-86wc-4qgf

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

HIGH 79

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.81759 Published 2022-07-19 Partial fix · 2.7.3 CWE-681

TI-2024-27518 CVE-2024-41172 · GHSA-4mgg-fqfq-64hg

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

MEDIUM 41

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consump…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01197 Published 2024-07-19 Partial fix · 3.6.4, 4.0.5 CWE-401

TI-2023-28776 CVE-2023-52428 · GHSA-gvpg-vgmx-xg6w

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service…

MEDIUM 40

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00814 Published 2024-02-11 Partial fix · 9.37.2 CWE-770

TI-2024-08067 CVE-2024-8698 · GHSA-xgfv-xpx8-qhcr

Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

LOW 38

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0203 Published 2024-09-19 Partial fix · 25.0.5, 22.0.13-1 +81 CWE-347

TI-2024-08248 CVE-2024-8883 · GHSA-w8gr-xwp4-r9f7

Keycloak: vulnerable redirect uri validation results in open redirec

LOW 33

A misconfiguration flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02112 Published 2024-09-19 Fixed in 22.0.12, 24.0.7 +87 CWE-601

TI-2024-31841 CVE-2024-47554 · GHSA-78wr-2p64-hpwj

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

LOW 23

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01315 Published 2024-10-03 Partial fix · 2.14.0 CWE-400

TI-2024-03758 CVE-2024-4029 · GHSA-x7g6-rwhc-g7mj

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

LOW 19

A vulnerability was found in Wildfly’s management interface.

CVSS 3.1MEDIUM 4.1 Local High privileges No interaction EPSS 0.00277 Published 2024-05-02 Partial fix · 24.0.1.Final, 25.0.0.Final +102 CWE-770