Skip to content
OpenAdvisories
High RHSA-2024:1192 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update

Published Oct 1, 2024 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-apache-sshd 0:2.12.0-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-eclipse-jgit 0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-log4j 0:2.19.0-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-analyzers-common 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-core 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-facet 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-join 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-queries 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-queryparser 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-lucene-solr 0:8.11.2-2.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-parsson 0:1.1.5-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-wildfly 0:8.0.1-3.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-wildfly-java-jdk11 0:8.0.1-3.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-wildfly-java-jdk17 0:8.0.1-3.GA_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 eap8-wildfly-modules 0:8.0.1-3.GA_redhat_00002.1.el8eap

Vulnerabilities 4

  • High 8.8
    CVE-2023-4759

    Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

    Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cl…

    Eclipse Foundation Eclipse JGit org.eclipse.jgit:org.eclipse.jgit jgit Debian Ubuntu Maven
  • Medium 5.9
    CVE-2023-4043

    Parsson DoS when parsing numbers from untrusted sources

    In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a n…

    Eclipse Foundation Parsson org.eclipse.parsson:project Maven
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  • Medium 5.0
    CVE-2023-35887 Public exploit

    Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

    Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-core Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2238614
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2240036
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2254210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2254594
  • article
    https://issues.redhat.com/browse/JBEAP-26209
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1192.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-4043
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-4043
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-4043
  • report
    https://access.redhat.com/security/cve/CVE-2023-4759
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-4759
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-4759
  • report
    https://access.redhat.com/security/cve/CVE-2023-35887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-35887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-35887
  • report
    https://access.redhat.com/security/cve/CVE-2023-48795
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-48795
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-48795
  • article
    https://access.redhat.com/solutions/7071748
  • article
    https://terrapin-attack.com/