Red Hat Security AdvisoryRHSA-2025:17298
Red Hat JBoss Enterprise Application Platform 8.1.0 security update
Released 2025-10-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-apache-commons-lang-3.18.0-1.redhat_00002.1.el8eap, eap8-apache-cxf-4.0.9-4.redhat_00002.1.el8eap, eap8-apache-cxf-rt-4.0.9-4.redhat_00002.1.el8eap +46
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-apache-commons-lang-3.18.0-1.redhat_00002.1.el9eap, eap8-apache-cxf-4.0.9-4.redhat_00002.1.el9eap, eap8-apache-cxf-rt-4.0.9-4.redhat_00002.1.el9eap +46
Fixes 3 records
Priority MEDIUM 51
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01072 · Published 2025-08-08 · Partial fix · 4.1.3, 4.0.9 +1 CWE-20
Priority MEDIUM 44
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.01125 · Published 2025-08-13 · Partial fix · 4.1.124.Final, 4.2.4.Final +1 CWE-770
Priority LOW 16
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.
CVSS 4.0LOW 2.9· Network · No auth · No interaction · EPSS 0.0071 · Published 2025-09-03 · Partial fix · 4.2.5.Final, 4.1.125.Final CWE-444
