Skip to content
OpenAdvisories
Critical RHSA-2023:0163 1 CVE

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

Published Sep 27, 2024 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-apache-cxf 0:3.4.10-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-apache-cxf-rt 0:3.4.10-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-apache-cxf-services 0:3.4.10-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-apache-cxf-tools 0:3.4.10-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el8 eap7-apache-cxf 0:3.4.10-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el8 eap7-apache-cxf-rt 0:3.4.10-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el8 eap7-apache-cxf-services 0:3.4.10-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el8 eap7-apache-cxf-tools 0:3.4.10-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el9 eap7-apache-cxf 0:3.4.10-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el9 eap7-apache-cxf-rt 0:3.4.10-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el9 eap7-apache-cxf-services 0:3.4.10-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el9 eap7-apache-cxf-tools 0:3.4.10-1.redhat_00001.1.el9eap

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-46364 Public exploit

    Apache CXF SSRF Vulnerability

    A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

    Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2155682
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0163.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-46364
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-46364
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-46364
  • article
    https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2