Red Hat Security Advisory

RHSA-2025:4549

Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Released 2025-05-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.16.1-1.redhat_00001.1.el8eap, eap7-hal-console-3.3.26-1.Final_redhat_00001.1.el8eap, eap7-ironjacamar-1.5.19-1.Final_redhat_00001.1.el8eap +27

Fixes 4 records

TI-2025-18650 CVE-2025-24970 · GHSA-4g8c-wm8x-jfhw

SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

HIGH 72

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02192 Published 2025-02-10 Partial fix · 4.1.118.Final CWE-20

TI-2025-18862 CVE-2025-25193 · GHSA-389x-839f-4rhx

Denial of Service attack on windows app using Netty

MEDIUM 58

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00391 Published 2025-02-10 Partial fix · 4.1.118.Final CWE-400

TI-2024-31824 CVE-2024-47535 · GHSA-xq3w-v528-46rv

Denial of Service attack on windows app using Netty

MEDIUM 58

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00408 Published 2024-11-12 Fixed in 4.1.115, 4.1.115.Final CWE-400

TI-2024-31841 CVE-2024-47554 · GHSA-78wr-2p64-hpwj

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

LOW 23

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01315 Published 2024-10-03 Partial fix · 2.14.0 CWE-400