Skip to content
OpenAdvisories
High RHSA-2017:1412 4 CVEs

Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-jboss-ec2-eap 0:7.0.6-1.GA_redhat_1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-jboss-ec2-eap-samples 0:7.0.6-1.GA_redhat_1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el7 eap7-jboss-ec2-eap 0:7.0.6-1.GA_redhat_1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el7 eap7-jboss-ec2-eap-samples 0:7.0.6-1.GA_redhat_1.ep7.el7

Vulnerabilities 4

  • High 8.1
    CVE-2016-9606

    JBoss RESTEasy vulnerable to Improper Input Validation

    JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

    Red Hat RESTEasy resteasy resteasy3.0 Debian Ubuntu Maven
  • High 7.7
    CVE-2017-2595

    It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…

    [UNKNOWN] wildfly
  • High 7.5
    CVE-2017-2670

    Moderate severity vulnerability that affects io.undertow:undertow-core

    It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  • Medium 6.5
    CVE-2017-2666 Public exploit

    Undertow-core vulnerable to HTTP Request Smuggling

    It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
  • article
    https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/installation-guide/
  • article
    https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1400644
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1413028
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1436163
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1438885
  • article
    https://issues.redhat.com/browse/JBEAP-8077
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1412.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-9606
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9606
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9606
  • report
    https://access.redhat.com/security/cve/CVE-2017-2595
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2595
  • report
    https://access.redhat.com/security/cve/CVE-2017-2666
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2666
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2666
  • report
    https://access.redhat.com/security/cve/CVE-2017-2670
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2670
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2670