Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update

Fixed packages 108

Vulnerabilities 9

• Critical 9.8
  CVE-2022-4492

  Undertow client not checking server identity presented by server certificate in https connections

  The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Feb 23, 2023
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 8.0
  CVE-2022-41853 Public exploit

  Remote code execution in HyperSQL DataBase

  Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath re…

  HyperSQL DataBase hsqldb hsqldb hsqldb Debian Ubuntu Maven
  Oct 6, 2022
• High 7.5
  CVE-2023-1108

  Undertow: infinite loop in sslconduit during close

  A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Sep 14, 2023
• Medium 6.5
  CVE-2022-38752

  DoS in SnakeYAML

  Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven
  Sep 5, 2022
• Medium 5.8
  CVE-2022-41854

  Stack Overflow in Snakeyaml

  Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may suppor…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat Debian Wolfi Maven
  Nov 11, 2022
• Medium 5.5
  CVE-2022-45787

  Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

  Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j…

  Apache Software Foundation Apache James Mime4J org.apache.james:apache-mime4j-storage Maven
  Jan 6, 2023
• Medium 5.5
  CVE-2023-0482 Public exploit

  Insecure Temporary File in RESTEasy

  In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

  resteasy resteasy3.0 resteasy3.0 org.jboss.resteasy:resteasy-core Debian Ubuntu Maven
  Feb 17, 2023
• Medium 5.3
  CVE-2022-41881

  HAProxyMessageDecoder Stack Exhaustion DoS

  Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

  netty netty netty netty Debian Ubuntu Maven
  Dec 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2129710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136141
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2151988
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2158916
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166004
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2174246
• article
  https://issues.redhat.com/browse/JBEAP-23572
• article
  https://issues.redhat.com/browse/JBEAP-24121
• article
  https://issues.redhat.com/browse/JBEAP-24172
• article
  https://issues.redhat.com/browse/JBEAP-24182
• article
  https://issues.redhat.com/browse/JBEAP-24220
• article
  https://issues.redhat.com/browse/JBEAP-24254
• article
  https://issues.redhat.com/browse/JBEAP-24292
• article
  https://issues.redhat.com/browse/JBEAP-24339
• article
  https://issues.redhat.com/browse/JBEAP-24341
• article
  https://issues.redhat.com/browse/JBEAP-24363
• article
  https://issues.redhat.com/browse/JBEAP-24372
• article
  https://issues.redhat.com/browse/JBEAP-24380
• article
  https://issues.redhat.com/browse/JBEAP-24383
• article
  https://issues.redhat.com/browse/JBEAP-24384
• article
  https://issues.redhat.com/browse/JBEAP-24385
• article
  https://issues.redhat.com/browse/JBEAP-24395
• article
  https://issues.redhat.com/browse/JBEAP-24507
• article
  https://issues.redhat.com/browse/JBEAP-24574
• article
  https://issues.redhat.com/browse/JBEAP-24588
• article
  https://issues.redhat.com/browse/JBEAP-24605
• article
  https://issues.redhat.com/browse/JBEAP-24618
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1513.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1471
• article
  https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
• report
  https://access.redhat.com/security/cve/CVE-2022-4492