Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update

Fixed packages 62

Vulnerabilities 8

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.5
  CVE-2023-39410

  Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

  When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11…

  Apache Software Foundation Apache Avro Java SDK druid tez Wolfi Maven PyPI
  Sep 29, 2023
• High 7.5
  CVE-2023-5685

  Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

  A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Mar 22, 2024
• Medium 6.8
  CVE-2023-4503

  Eap-galleon: custom provisioning creates unsecured http-invoker

  An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  Feb 6, 2024
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 5.3
  CVE-2023-26048 Public exploit

  OutOfMemoryError for large multipart without filename in Eclipse Jetty

  Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023
• Medium 5.0
  CVE-2023-35887 Public exploit

  Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

  Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-common Wolfi Maven
  Jul 10, 2023
• Low 2.4
  CVE-2023-26049 Public exploit

  Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

  Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184751
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215229
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240036
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• article
  https://issues.redhat.com/browse/JBEAP-25004
• article
  https://issues.redhat.com/browse/JBEAP-25085
• article
  https://issues.redhat.com/browse/JBEAP-25086
• article
  https://issues.redhat.com/browse/JBEAP-25378
• article
  https://issues.redhat.com/browse/JBEAP-25380
• article
  https://issues.redhat.com/browse/JBEAP-25419
• article
  https://issues.redhat.com/browse/JBEAP-25451
• article
  https://issues.redhat.com/browse/JBEAP-25457
• article
  https://issues.redhat.com/browse/JBEAP-25541
• article
  https://issues.redhat.com/browse/JBEAP-25547
• article
  https://issues.redhat.com/browse/JBEAP-25576
• article
  https://issues.redhat.com/browse/JBEAP-25594
• article
  https://issues.redhat.com/browse/JBEAP-25627
• article
  https://issues.redhat.com/browse/JBEAP-25657
• article
  https://issues.redhat.com/browse/JBEAP-25685
• article
  https://issues.redhat.com/browse/JBEAP-25700
• article
  https://issues.redhat.com/browse/JBEAP-25716
• article
  https://issues.redhat.com/browse/JBEAP-25726
• article
  https://issues.redhat.com/browse/JBEAP-25772
• article
  https://issues.redhat.com/browse/JBEAP-25779
• article
  https://issues.redhat.com/browse/JBEAP-25803
• article
  https://issues.redhat.com/browse/JBEAP-25838
• article
  https://issues.redhat.com/browse/JBEAP-26041
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7638.json
• report
  https://access.redhat.com/security/cve/CVE-2023-2976
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2976
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2976
• report
  https://access.redhat.com/security/cve/CVE-2023-4503