Skip to content
OpenAdvisories
High RHSA-2019:4018 6 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update

Published Sep 20, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 97

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-apache-cxf 0:3.2.10-1.redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-apache-cxf-rt 0:3.2.10-1.redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-apache-cxf-services 0:3.2.10-1.redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-apache-cxf-tools 0:3.2.10-1.redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-byte-buddy 0:1.9.11-1.redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-glassfish-jsf 0:2.3.5-5.SP3_redhat_00003.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hal-console 0:3.0.17-2.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hibernate 0:5.3.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hibernate-core 0:5.3.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hibernate-entitymanager 0:5.3.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hibernate-envers 0:5.3.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-hibernate-java8 0:5.3.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-common-api 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-common-impl 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-common-spi 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-core-api 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-core-impl 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-deployers-common 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-jdbc 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-ironjacamar-validator 0:1.4.18-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-genericjms 0:2.0.2-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-msc 0:1.4.11-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-remoting 0:5.0.16-2.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-cli 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-core 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap6.4 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap6.4-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap7.0 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap7.0-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap7.1 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap7.1-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly10.0 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly10.0-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly10.1 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly10.1-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly11.0 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly11.0-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly12.0 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly12.0-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly13.0-server 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly14.0-server 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly8.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly8.2-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly9.0 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-server-migration-wildfly9.0-to-eap7.2 0:1.3.1-6.Final_redhat_00006.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-jboss-xnio-base 0:3.7.6-2.SP1_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketbox 0:5.0.3-6.Final_redhat_00005.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketbox-infinispan 0:5.0.3-6.Final_redhat_00005.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-api 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-bindings 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-common 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-config 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-federation 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-idm-api 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-idm-impl 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-idm-simple-schema 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-impl 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-picketlink-wildfly8 0:2.5.5-20.SP12_redhat_00009.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-atom-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-cdi 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-client 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-client-microprofile 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-crypto 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jackson-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jackson2-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jaxb-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jaxrs 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jettison-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jose-jwt 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-jsapi 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-json-binding-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-json-p-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-multipart-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-rxjava2 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-spring 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-validator-provider-11 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-resteasy-yaml-provider 0:3.6.1-7.SP7_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-undertow 0:2.0.26-2.SP3_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly 0:7.2.5-4.GA_redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-elytron 0:1.6.5-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-elytron-tool 0:1.4.4-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-http-client 0:1.0.17-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-http-client-common 0:1.0.17-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-http-ejb-client 0:1.0.17-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-http-naming-client 0:1.0.17-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-http-transaction-client 0:1.0.17-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-javadocs 0:7.2.5-4.GA_redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-modules 0:7.2.5-4.GA_redhat_00002.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-openssl 0:1.0.8-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-openssl-java 0:1.0.8-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-openssl-linux-x86_64 0:1.0.8-5.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-wildfly-openssl-linux-x86_64-debuginfo 0:1.0.8-5.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-yasson 0:1.0.5-1.redhat_00001.1.el6eap

Vulnerabilities 6

  • High 7.5
    CVE-2019-14843

    A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. Th…

    Red Hat wildfly-security-manager
  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9512 EPSS 83%

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…

    go stdlib golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2019-9514 EPSS 83%

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depe…

    nodejs go golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2019-9515 EPSS 87%

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an …

    nodejs trafficserver netty trafficserver Debian Ubuntu Alpine
  • Medium 5.2
    CVE-2019-14838

    Wildfly Authorization Misconfiguration

    A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

    Red Hat wildfly-core org.wildfly.core:wildfly-host-controller Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735645
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735744
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735745
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741860
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1751227
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752980
  • article
    https://issues.redhat.com/browse/JBEAP-17075
  • article
    https://issues.redhat.com/browse/JBEAP-17220
  • article
    https://issues.redhat.com/browse/JBEAP-17365
  • article
    https://issues.redhat.com/browse/JBEAP-17476
  • article
    https://issues.redhat.com/browse/JBEAP-17478
  • article
    https://issues.redhat.com/browse/JBEAP-17483
  • article
    https://issues.redhat.com/browse/JBEAP-17495
  • article
    https://issues.redhat.com/browse/JBEAP-17496
  • article
    https://issues.redhat.com/browse/JBEAP-17513
  • article
    https://issues.redhat.com/browse/JBEAP-17521
  • article
    https://issues.redhat.com/browse/JBEAP-17523
  • article
    https://issues.redhat.com/browse/JBEAP-17547
  • article
    https://issues.redhat.com/browse/JBEAP-17548
  • article
    https://issues.redhat.com/browse/JBEAP-17560
  • article
    https://issues.redhat.com/browse/JBEAP-17579
  • article
    https://issues.redhat.com/browse/JBEAP-17582
  • article
    https://issues.redhat.com/browse/JBEAP-17603
  • article
    https://issues.redhat.com/browse/JBEAP-17631
  • article
    https://issues.redhat.com/browse/JBEAP-17647
  • article
    https://issues.redhat.com/browse/JBEAP-17665
  • article
    https://issues.redhat.com/browse/JBEAP-17722
  • article
    https://issues.redhat.com/browse/JBEAP-17874
  • article
    https://issues.redhat.com/browse/JBEAP-17880
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4018.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-9511
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9511
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9511
  • article
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  • article
    https://kb.cert.org/vuls/id/605641/
  • article
    https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/