Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update

Fixed packages 30

Vulnerabilities 3

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery minimist node-minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 7.7
  CVE-2022-25647 EPSS 12%

  Deserialization of Untrusted Data

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

  openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  May 1, 2022
• Medium 5.5
  CVE-2022-24823

  Local Information Disclosure Vulnerability in io.netty:netty-codec-http

  Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…

  netty netty netty netty Debian Ubuntu Maven
  May 6, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2080850
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087186
• article
  https://issues.redhat.com/browse/JBEAP-17119
• article
  https://issues.redhat.com/browse/JBEAP-23344
• article
  https://issues.redhat.com/browse/JBEAP-23360
• article
  https://issues.redhat.com/browse/JBEAP-23444
• article
  https://issues.redhat.com/browse/JBEAP-23492
• article
  https://issues.redhat.com/browse/JBEAP-23526
• article
  https://issues.redhat.com/browse/JBEAP-23528
• article
  https://issues.redhat.com/browse/JBEAP-23546
• article
  https://issues.redhat.com/browse/JBEAP-23550
• article
  https://issues.redhat.com/browse/JBEAP-23551
• article
  https://issues.redhat.com/browse/JBEAP-23554
• article
  https://issues.redhat.com/browse/JBEAP-23556
• article
  https://issues.redhat.com/browse/JBEAP-23557
• article
  https://issues.redhat.com/browse/JBEAP-23559
• article
  https://issues.redhat.com/browse/JBEAP-23561
• article
  https://issues.redhat.com/browse/JBEAP-23566
• article
  https://issues.redhat.com/browse/JBEAP-23571
• article
  https://issues.redhat.com/browse/JBEAP-23626
• article
  https://issues.redhat.com/browse/JBEAP-23659
• article
  https://issues.redhat.com/browse/JBEAP-23671
• article
  https://issues.redhat.com/browse/JBEAP-23686
• article
  https://issues.redhat.com/browse/JBEAP-23726
• article
  https://issues.redhat.com/browse/JBEAP-23728
• article
  https://issues.redhat.com/browse/JBEAP-23806
• article
  https://issues.redhat.com/browse/JBEAP-23807
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5892.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-24823
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24823
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24823