Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8

Fixed packages 103

Vulnerabilities 7

• High 7.5
  CVE-2023-26464

  Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

  ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on wh…

  Apache Software Foundation Apache Log4j druid org.apache.logging.log4j:log4j-core Ubuntu Wolfi Maven
  Mar 10, 2023
• High 7.5
  CVE-2023-3171

  Eap-7: heap exhaustion via deserialization

  A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could ev…

  Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  Dec 27, 2023
• Medium 6.5
  CVE-2023-26136 Public exploit

  tough-cookie Prototype Pollution vulnerability

  Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-pbt-enas Debian Ubuntu Azure Linux Wolfi npm
  Jul 1, 2023
• Medium 6.5
  CVE-2023-34462

  netty-handler SniHandler 16MB allocation

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

  netty netty netty netty Debian Ubuntu Wolfi Maven
  Jun 22, 2023
• Medium 6.5
  CVE-2023-4061

  Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

  A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitiv…

  Red Hat Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Maven
  Nov 8, 2023
• Medium 5.3
  CVE-2022-25883

  semver vulnerable to Regular Expression Denial of Service

  Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

  nodejs js-jquery nodejs18 nodejs-nodemon Debian Ubuntu Azure Linux npm
  Jun 21, 2023
• Medium 5.3
  CVE-2023-33201

  Bouncy Castle For Java LDAP injection vulnerability

  Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

  druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven
  Jul 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216888
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228608
• article
  https://issues.redhat.com/browse/JBEAP-24667
• article
  https://issues.redhat.com/browse/JBEAP-24798
• article
  https://issues.redhat.com/browse/JBEAP-24966
• article
  https://issues.redhat.com/browse/JBEAP-24985
• article
  https://issues.redhat.com/browse/JBEAP-25032
• article
  https://issues.redhat.com/browse/JBEAP-25033
• article
  https://issues.redhat.com/browse/JBEAP-25078
• article
  https://issues.redhat.com/browse/JBEAP-25122
• article
  https://issues.redhat.com/browse/JBEAP-25135
• article
  https://issues.redhat.com/browse/JBEAP-25186
• article
  https://issues.redhat.com/browse/JBEAP-25200
• article
  https://issues.redhat.com/browse/JBEAP-25225
• article
  https://issues.redhat.com/browse/JBEAP-25261
• article
  https://issues.redhat.com/browse/JBEAP-25285
• article
  https://issues.redhat.com/browse/JBEAP-25312
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5485.json
• report
  https://access.redhat.com/security/cve/CVE-2022-25883
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25883
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25883
• advisory
  https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
• article
  https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
• report
  https://access.redhat.com/security/cve/CVE-2023-3171
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3171
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3171
• report
  https://access.redhat.com/security/cve/CVE-2023-4061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4061
• report
  https://access.redhat.com/security/cve/CVE-2023-26136
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-26136