Red Hat Security AdvisoryRHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.3.12 security update
Released 2025-02-24 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
Fixes 13 records
Priority CRITICAL 100KEV
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other J…
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.99999 · Published 2021-12-10 · Partial fix · 2.15.0, 2.3.1 +5 CWE-20
Priority CRITICAL 98KEV
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.99977 · Published 2021-12-14 · Partial fix · 2.16.0, 2.12.2 +5 CWE-917
Priority CRITICAL 94
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99931 · Published 2022-10-13 · Partial fix · 1.10.0 CWE-94
Priority CRITICAL 88
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99501 · Published 2022-12-01 · Partial fix · 2.0 CWE-20
Priority HIGH 83
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.83176 · Published 2022-01-07 · Partial fix · 2.0.206 CWE-502
Priority HIGH 82
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0381 · Published 2022-11-16 · Partial fix · 2.9.2 CWE-502
Priority HIGH 72
Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01488 · Published 2022-12-13 · Partial fix · 1.5.2 CWE-787
Priority HIGH 72
Netty project is an event-driven asynchronous network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01577 · Published 2022-12-12 · Partial fix · 4.1.86.Final CWE-674
Priority MEDIUM 58
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.22709 · Published 2021-03-10 · Partial fix · 2.3 CWE-20
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 45
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4 CWE-502
Priority MEDIUM 41
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01261 · Published 2022-12-13 · Partial fix · 3.5.5, 3.4.10 CWE-20
Priority LOW 39
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4.2 CWE-502
THREATIST.IORead the docs