Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

Fixed packages 8

Vulnerabilities 3

• High 7.5
  CVE-2021-46877

  jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

  jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 18, 2023
• High 7.5
  CVE-2023-3223

  Undertow: outofmemoryerror due to @multipartconfig handling

  A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 RHEL-8 based Middleware Containers Debian Ubuntu Maven
  Sep 27, 2023
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185707
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2209689
• article
  https://issues.redhat.com/browse/JBEAP-24711
• article
  https://issues.redhat.com/browse/JBEAP-24722
• article
  https://issues.redhat.com/browse/JBEAP-24744
• article
  https://issues.redhat.com/browse/JBEAP-24745
• article
  https://issues.redhat.com/browse/JBEAP-24790
• article
  https://issues.redhat.com/browse/JBEAP-24808
• article
  https://issues.redhat.com/browse/JBEAP-24819
• article
  https://issues.redhat.com/browse/JBEAP-24820
• article
  https://issues.redhat.com/browse/JBEAP-24821
• article
  https://issues.redhat.com/browse/JBEAP-24822
• article
  https://issues.redhat.com/browse/JBEAP-24831
• article
  https://issues.redhat.com/browse/JBEAP-24832
• article
  https://issues.redhat.com/browse/JBEAP-24835
• article
  https://issues.redhat.com/browse/JBEAP-24836
• article
  https://issues.redhat.com/browse/JBEAP-24858
• article
  https://issues.redhat.com/browse/JBEAP-24973
• article
  https://issues.redhat.com/browse/JBEAP-25004
• article
  https://issues.redhat.com/browse/JBEAP-25085
• article
  https://issues.redhat.com/browse/JBEAP-25086
• article
  https://issues.redhat.com/browse/JBEAP-25204
• article
  https://issues.redhat.com/browse/JBEAP-25205
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4507.json
• report
  https://access.redhat.com/security/cve/CVE-2021-46877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-46877
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-46877
• report
  https://access.redhat.com/security/cve/CVE-2023-1436
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1436
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1436
• article
  https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/
• report
  https://access.redhat.com/security/cve/CVE-2023-3223
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3223