High RHSA-2024:2764 3 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 security update

Published Sep 27, 2024 · Updated Oct 8, 2026

Ecosystem: Red Hat

Fixed packages 2

Release	Package	Fixed in
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8	eap8-undertow	0:2.3.11-1.SP1_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9	eap8-undertow	0:2.3.11-1.SP1_redhat_00001.1.el9eap

Vulnerabilities 3

High 7.5

CVE-2023-1973

Undertow: unrestricted request storage leads to memory exhaustion

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

Red Hat Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Debian Ubuntu Maven

Nov 7, 2024
High 7.4

CVE-2023-4639

Undertow: cookie smuggling/spoofing

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional coo…

Red Hat Red Hat Single Sign-On 7 Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Debian Ubuntu Maven

Nov 17, 2024
Medium 5.3

CVE-2024-1459

Undertow: directory traversal vulnerability

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and dire…

Red Hat Red Hat Single Sign-On 7 Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Debian Ubuntu Maven

Feb 12, 2024

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2166022
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2764.json
report
https://access.redhat.com/security/cve/CVE-2023-1973
report
https://bugzilla.redhat.com/show_bug.cgi?id=2185662
advisory
https://www.cve.org/CVERecord?id=CVE-2023-1973
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1973
report
https://access.redhat.com/security/cve/CVE-2023-4639
advisory
https://www.cve.org/CVERecord?id=CVE-2023-4639
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-4639
report
https://access.redhat.com/security/cve/CVE-2024-1459
report
https://bugzilla.redhat.com/show_bug.cgi?id=2259475
advisory
https://www.cve.org/CVERecord?id=CVE-2024-1459
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-1459