Skip to content
OpenAdvisories
High RHSA-2018:2741 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 89

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 codehaus-jackson 0:1.9.9-14.redhat_7.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 codehaus-jackson-core-asl 0:1.9.9-14.redhat_7.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 codehaus-jackson-jaxrs 0:1.9.9-14.redhat_7.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 codehaus-jackson-mapper-asl 0:1.9.9-14.redhat_7.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 codehaus-jackson-xc 0:1.9.9-14.redhat_7.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 guava-libraries 0:13.0.1-5.redhat_3.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 hibernate4-validator 0:4.3.4-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 hornetq 0:2.3.25-27.SP28_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-common-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-common-impl-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-common-spi-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-core-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-core-impl-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-deployers-common-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-jdbc-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-spec-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 ironjacamar-validator-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-appclient 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-cli 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-client-all 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-clustering 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-cmp 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-configadmin 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-connector 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-controller-client 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-core-security 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-deployment-repository 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-deployment-scanner 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-domain-http 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-domain-management 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-ee 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-ee-deployment 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-ejb3 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-embedded 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-host-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jacorb 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jaxr 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jaxrs 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jdr 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jmx 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jpa 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jsf 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-jsr77 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-logging 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-mail 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-management-client-content 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-messaging 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-modcluster 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-naming 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-network 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-osgi 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-osgi-configadmin 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-osgi-service 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-picketlink 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-platform-mbean 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-pojo 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-process-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-protocol 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-remoting 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-sar 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-security 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-server 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-system-jmx 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-threads 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-transactions 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-version 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-web 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-webservices 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-weld 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-as-xts 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-ejb-client 0:1.0.41-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-modules 0:1.3.11-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-vfs2 0:3.2.13-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jboss-xnio-base 0:3.0.17-1.GA_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-appclient 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-bundles 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-core 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-domain 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-javadocs 0:7.5.21-2.Final_redhat_1.2.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-modules-eap 0:7.5.21-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-product-eap 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-standalone 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossas-welcome-content-eap 0:7.5.21-2.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 jbossweb 0:7.5.29-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 picketlink-bindings 0:2.5.4-23.SP18_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 picketlink-federation 0:2.5.4-21.SP18_redhat_2.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 xerces-j2-eap6 0:2.9.1-19.redhat_8.1.ep6.el7

Vulnerabilities 4

  • High 7.5
    CVE-2018-1336 EPSS 20%

    In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.0
    CVE-2017-7536

    Privilege Escalation in Hibernate Validator

    In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

    Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  • Medium 6.5
    CVE-2017-2582

    keycloak-core discloses system properties

    It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Medium 5.9
    CVE-2018-10237

    Denial of Service in Google Guava

    Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (w…

    druid guava-libraries com.google.guava:guava guava-libraries Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1261190
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1410481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1465573
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1570200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573391
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1578830
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1580440
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1594389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1602226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1606334
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607591
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1610355
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1610742
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1611770
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1614448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1615347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1615380
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2741.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-2582
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2582
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2582
  • report
    https://access.redhat.com/security/cve/CVE-2017-7536
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-7536
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-7536
  • report
    https://access.redhat.com/security/cve/CVE-2018-1336
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1336
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1336
  • report
    https://access.redhat.com/security/cve/CVE-2018-10237
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-10237
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-10237
  • article
    https://github.com/google/guava/wiki/CVE-2018-10237
  • article
    https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion