Skip to content
OpenAdvisories
Critical RHSA-2017:3458 17 CVEs

Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Published Sep 20, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-jboss-ec2-eap 0:7.1.0-5.GA_redhat_5.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-jboss-ec2-eap-samples 0:7.1.0-5.GA_redhat_5.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-jboss-ec2-eap 0:7.1.0-5.GA_redhat_5.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-jboss-ec2-eap-samples 0:7.1.0-5.GA_redhat_5.ep7.el7

Vulnerabilities 17

  • Critical 9.8
    CVE-2017-7525 Public exploit EPSS 38%

    jackson-databind is vulnerable to a deserialization flaw

    A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

    FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  • High 7.7
    CVE-2017-2595

    It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…

    [UNKNOWN] wildfly
  • High 7.5
    CVE-2016-9589

    Red Hat Wildfly DoS

    Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill m…

    Red Hat wildfly org.wildfly:wildfly-undertow Maven
  • High 7.5
    CVE-2017-2670

    Moderate severity vulnerability that affects io.undertow:undertow-core

    It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  • High 7.2
    CVE-2016-4978

    Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain

    The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Art…

    org.apache.activemq:artemis-pom Maven
  • High 7.0
    CVE-2016-8656

    Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script…

    jboss jbossas
  • High 7.0
    CVE-2017-7536

    Privilege Escalation in Hibernate Validator

    In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

    Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  • Medium 6.5
    CVE-2017-2666 Public exploit

    Undertow-core vulnerable to HTTP Request Smuggling

    It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  • Medium 6.1
    CVE-2016-4993

    Improper Neutralization of CRLF Sequences in Wildfly Undertow

    CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi…

    undertow undertow org.wildfly:wildfly-undertow Debian Ubuntu Maven
  • Medium 6.1
    CVE-2017-7559

    Undertow vulnerable to Request Smuggling

    In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited…

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • Medium 5.9
    CVE-2016-7046

    Undertow Uncaught Exception vulnerability

    Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 5.5
    CVE-2017-12167

    It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuratio…

    Red Hat EAP-7
  • Medium 4.3
    CVE-2016-8627

    admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…

    [UNKNOWN] admin-cli
  • Low 3.5
    CVE-2016-7061

    An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discove…

    Red Hat EAP
  • Low 2.6
    CVE-2017-12165

    Undertow Request Smuggling vulnerability

    It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • Unscored —
    CVE-2016-5406

    The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticat…

  • Unscored —
    CVE-2016-6311

    Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers.

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1344321
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1359014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1362735
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1376646
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1379207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1380852
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1388240
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1400344
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1404782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1413028
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1436163
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1438885
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1462702
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1465573
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1481665
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1490301
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1491612
  • article
    https://issues.redhat.com/browse/JBEAP-5324
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3458.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-4978
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-4978
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-4978
  • report
    https://access.redhat.com/security/cve/CVE-2016-4993
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-4993
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-4993
  • report
    https://access.redhat.com/security/cve/CVE-2016-5406
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5406
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5406
  • report
    https://access.redhat.com/security/cve/CVE-2016-6311
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6311
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6311
  • report
    https://access.redhat.com/security/cve/CVE-2016-7046
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-7046
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-7046
  • report
    https://access.redhat.com/security/cve/CVE-2016-7061
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-7061
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-7061