Skip to content
OpenAdvisories
Critical RHSA-2022:4918 14 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7

Published Sep 29, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 60

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-cli 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-commons 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-core-client 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-dto 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-hornetq-protocol 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-hqclient-protocol 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-jdbc-store 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-jms-client 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-jms-server 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-journal 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-ra 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-selector 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-server 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-service-extensions 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-activemq-artemis-tools 0:2.16.0-9.redhat_00042.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-h2database 0:1.4.197-2.redhat_00004.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-hal-console 0:3.3.12-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jackson-databind 0:2.12.6.1-1.redhat_00003.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jboss-xnio-base 0:3.8.7-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-all 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-buffer 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-dns 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-haproxy 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-http 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-http2 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-memcache 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-mqtt 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-redis 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-smtp 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-socks 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-stomp 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-codec-xml 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-common 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-handler 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-handler-proxy 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-resolver 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-resolver-dns 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-resolver-dns-classes-macos 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-classes-epoll 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-classes-kqueue 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-native-unix-common 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-rxtx 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-sctp 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-netty-transport-udt 0:4.1.72-4.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-undertow 0:2.2.17-2.SP4_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly 0:7.4.5-3.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-http-client 0:1.1.11-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-http-client-common 0:1.1.11-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-http-ejb-client 0:1.1.11-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-http-naming-client 0:1.1.11-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-http-transaction-client 0:1.1.11-1.SP1_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-java-jdk11 0:7.4.5-3.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-java-jdk8 0:7.4.5-3.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-javadocs 0:7.4.5-3.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-modules 0:7.4.5-3.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-xerces-j2 0:2.12.0-3.SP04_redhat_00001.1.el7eap

Vulnerabilities 14

  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-23221 Public exploit EPSS 65%

    Arbitrary code execution in H2 Console

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

    com.h2database:h2 h2database h2database Debian Ubuntu Maven
  • High 7.5
    CVE-2020-36518 Public exploit

    Deeply nested json in jackson-databind

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

    management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2021-37136

    Bzip2Decoder doesn't allow setting size restrictions for decompressed data

    The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2021-37137

    SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

    The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-0084

    XNIO `notifyReadClosed` method logging message to unexpected end

    A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…

    jboss-xnio jboss-xnio org.jboss.xnio:xnio-all Debian Ubuntu Maven
  • High 7.5
    CVE-2022-23913

    Apache ActiveMQ Artemis DoS

    In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

    Apache Software Foundation Apache ActiveMQ Artemis org.apache.activemq:artemis-core-client Maven
  • High 7.5
    CVE-2022-24785 Public exploit EPSS 14%

    Path Traversal in Moment.js

    Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…

    moment moment node-moment node-moment Debian Ubuntu npm NuGet
  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.5
    CVE-2022-23437 EPSS 12%

    Infinite loop within Apache XercesJ xml parser

    There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…

    Apache Software Foundation Apache Xerces xerces:xercesImpl libxerces2-java Debian Ubuntu Azure Linux Maven
  • Medium 5.3
    CVE-2022-21299

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  • Unscored —
    CVE-2022-0853 Public exploit

    A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using Us…

  • Unscored —
    CVE-2022-0866

    This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an…

  • Unscored —
    CVE-2022-1319

    A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those pack…

    undertow undertow Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2004133
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2004135
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031958
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2039403
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2041472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044596
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2047200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060725
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060929
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2063601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2072009
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2073890
  • article
    https://issues.redhat.com/browse/JBEAP-23120
  • article
    https://issues.redhat.com/browse/JBEAP-23171
  • article
    https://issues.redhat.com/browse/JBEAP-23194
  • article
    https://issues.redhat.com/browse/JBEAP-23241
  • article
    https://issues.redhat.com/browse/JBEAP-23299
  • article
    https://issues.redhat.com/browse/JBEAP-23300
  • article
    https://issues.redhat.com/browse/JBEAP-23312
  • article
    https://issues.redhat.com/browse/JBEAP-23313
  • article
    https://issues.redhat.com/browse/JBEAP-23336
  • article
    https://issues.redhat.com/browse/JBEAP-23338
  • article
    https://issues.redhat.com/browse/JBEAP-23339
  • article
    https://issues.redhat.com/browse/JBEAP-23351
  • article
    https://issues.redhat.com/browse/JBEAP-23353
  • article
    https://issues.redhat.com/browse/JBEAP-23429
  • article
    https://issues.redhat.com/browse/JBEAP-23432
  • article
    https://issues.redhat.com/browse/JBEAP-23451
  • article
    https://issues.redhat.com/browse/JBEAP-23531
  • article
    https://issues.redhat.com/browse/JBEAP-23532
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4918.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-36518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-36518
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-36518