Skip to content
OpenAdvisories
Unscored RHSA-2014:1040 1 CVE

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 resteasy 0:2.3.8-5.SP1_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 resteasy 0:2.3.8-5.SP1_redhat_1.1.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 resteasy 0:2.3.8-5.SP1_redhat_1.1.ep6.el7

Vulnerabilities 1

  • High —
    CVE-2014-3490

    Incorrect Privilege Assignment in RESTEasy

    RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote a…

    org.jboss.resteasy:resteasy-client Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1107901
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1040.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-3490
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3490
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3490