Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.15 security update

Fixed packages 53

Vulnerabilities 2

• High 8.8
  CVE-2023-4759

  Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

  Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cl…

  Eclipse Foundation Eclipse JGit org.eclipse.jgit:org.eclipse.jgit jgit Debian Ubuntu Maven
  Sep 12, 2023
• Medium 6.5
  CVE-2023-44483

  Apache Santuario: Private Key disclosure in debug-log output

  All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

  Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven
  Oct 20, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246070
• article
  https://issues.redhat.com/browse/JBEAP-25375
• article
  https://issues.redhat.com/browse/JBEAP-25616
• article
  https://issues.redhat.com/browse/JBEAP-25785
• article
  https://issues.redhat.com/browse/JBEAP-25944
• article
  https://issues.redhat.com/browse/JBEAP-26013
• article
  https://issues.redhat.com/browse/JBEAP-26021
• article
  https://issues.redhat.com/browse/JBEAP-26025
• article
  https://issues.redhat.com/browse/JBEAP-26049
• article
  https://issues.redhat.com/browse/JBEAP-26051
• article
  https://issues.redhat.com/browse/JBEAP-26101
• article
  https://issues.redhat.com/browse/JBEAP-26115
• article
  https://issues.redhat.com/browse/JBEAP-26159
• article
  https://issues.redhat.com/browse/JBEAP-26164
• article
  https://issues.redhat.com/browse/JBEAP-26169
• article
  https://issues.redhat.com/browse/JBEAP-26266
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0712.json
• report
  https://access.redhat.com/security/cve/CVE-2023-4759
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4759
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4759
• report
  https://access.redhat.com/security/cve/CVE-2023-44483
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-44483
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-44483
• article
  http://www.openwall.com/lists/oss-security/2023/10/20/5
• article
  https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55