Skip to content
OpenAdvisories
High RHSA-2017:0250 4 CVEs

Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap 0:7.5.13-1.Final_redhat_2.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap-samples 0:7.5.13-1.Final_redhat_2.ep6.el6

Vulnerabilities 4

  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.0
    CVE-2016-8656

    Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script…

    jboss jbossas
  • Medium 4.3
    CVE-2016-8627

    admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…

    [UNKNOWN] admin-cli
  • Low 3.5
    CVE-2016-7061

    An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discove…

    Red Hat EAP

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1380852
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1388240
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1400344
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0250.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-6816
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6816
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6816
  • article
    https://access.redhat.com/articles/2991951
  • article
    https://access.redhat.com/solutions/2891171
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
  • report
    https://access.redhat.com/security/cve/CVE-2016-7061
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-7061
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-7061
  • report
    https://access.redhat.com/security/cve/CVE-2016-8627
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-8627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-8627
  • report
    https://access.redhat.com/security/cve/CVE-2016-8656
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-8656
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-8656