Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.16 Security update

Fixed packages 68

Vulnerabilities 5

• High 7.5
  CVE-2023-1973

  Undertow: unrestricted request storage leads to memory exhaustion

  A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

  Red Hat Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Debian Ubuntu Maven
  Nov 7, 2024
• High 7.5
  CVE-2024-1635

  Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

  A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Debian Ubuntu Maven
  Feb 19, 2024
• High 7.4
  CVE-2023-4639

  Undertow: cookie smuggling/spoofing

  A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional coo…

  Red Hat Red Hat Single Sign-On 7 Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Debian Ubuntu Maven
  Nov 17, 2024
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 5.3
  CVE-2024-1459

  Undertow: directory traversal vulnerability

  A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and dire…

  Red Hat Red Hat Single Sign-On 7 Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Debian Ubuntu Maven
  Feb 12, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185662
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2264928
• article
  https://issues.redhat.com/browse/JBEAP-19969
• article
  https://issues.redhat.com/browse/JBEAP-26168
• article
  https://issues.redhat.com/browse/JBEAP-26280
• article
  https://issues.redhat.com/browse/JBEAP-26291
• article
  https://issues.redhat.com/browse/JBEAP-26318
• article
  https://issues.redhat.com/browse/JBEAP-26343
• article
  https://issues.redhat.com/browse/JBEAP-26355
• article
  https://issues.redhat.com/browse/JBEAP-26414
• article
  https://issues.redhat.com/browse/JBEAP-26467
• article
  https://issues.redhat.com/browse/JBEAP-26533
• article
  https://issues.redhat.com/browse/JBEAP-26552
• article
  https://issues.redhat.com/browse/JBEAP-26587
• article
  https://issues.redhat.com/browse/JBEAP-26616
• article
  https://issues.redhat.com/browse/JBEAP-26617
• article
  https://issues.redhat.com/browse/JBEAP-26636
• article
  https://issues.redhat.com/browse/JBEAP-26660
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1675.json
• report
  https://access.redhat.com/security/cve/CVE-2023-1973
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1973
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1973
• report
  https://access.redhat.com/security/cve/CVE-2023-4639
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4639
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4639
• report
  https://access.redhat.com/security/cve/CVE-2023-48795
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-48795
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-48795
• article
  https://access.redhat.com/solutions/7071748
• article
  https://terrapin-attack.com/
• report
  https://access.redhat.com/security/cve/CVE-2024-1459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259475
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1459