Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Fixed packages 2

Vulnerabilities 3

• High 7.5
  CVE-2022-2053

  Undertow vulnerable to Dos via Large AJP request

  When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a fron…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Aug 5, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• Unscored —
  CVE-2022-1259

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause …

  undertow Ubuntu
  Aug 31, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2095862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2126789
• article
  https://issues.redhat.com/browse/JBEAP-23619
• article
  https://issues.redhat.com/browse/JBEAP-23687
• article
  https://issues.redhat.com/browse/JBEAP-23738
• article
  https://issues.redhat.com/browse/JBEAP-23741
• article
  https://issues.redhat.com/browse/JBEAP-23753
• article
  https://issues.redhat.com/browse/JBEAP-23772
• article
  https://issues.redhat.com/browse/JBEAP-23794
• article
  https://issues.redhat.com/browse/JBEAP-23802
• article
  https://issues.redhat.com/browse/JBEAP-23803
• article
  https://issues.redhat.com/browse/JBEAP-23805
• article
  https://issues.redhat.com/browse/JBEAP-23816
• article
  https://issues.redhat.com/browse/JBEAP-23818
• article
  https://issues.redhat.com/browse/JBEAP-23869
• article
  https://issues.redhat.com/browse/JBEAP-23881
• article
  https://issues.redhat.com/browse/JBEAP-23912
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6822.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1259
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1259
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1259
• report
  https://access.redhat.com/security/cve/CVE-2022-2053
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2053
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2053
• report
  https://access.redhat.com/security/cve/CVE-2022-25857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25857
• article
  https://bitbucket.org/snakeyaml/snakeyaml/issues/525