Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Fixed packages 7

Vulnerabilities 3

• Critical 9.3
  CVE-2024-28752 Public exploit

  Apache CXF SSRF Vulnerability using the Aegis databinding

  A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the …

  Apache Software Foundation Apache CXF opensearch-2 org.apache.cxf:cxf-rt-databinding-aegis Wolfi Maven
  Mar 15, 2024
• High 7.3
  CVE-2024-1233

  Eap: wildfly-elytron has a ssrf security issue

  A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a serv…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Maven
  Apr 9, 2024
• Low 3.1
  CVE-2021-23445

  Cross-site Scripting (XSS)

  This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

  reaper datatables.net datatables.js datatables.js Debian Ubuntu Azure Linux npm
  Sep 27, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257732
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262849
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270732
• article
  https://issues.redhat.com/browse/JBEAP-25637
• article
  https://issues.redhat.com/browse/JBEAP-25786
• article
  https://issues.redhat.com/browse/JBEAP-26406
• article
  https://issues.redhat.com/browse/JBEAP-26438
• article
  https://issues.redhat.com/browse/JBEAP-26680
• article
  https://issues.redhat.com/browse/JBEAP-26692
• article
  https://issues.redhat.com/browse/JBEAP-26705
• article
  https://issues.redhat.com/browse/JBEAP-26718
• article
  https://issues.redhat.com/browse/JBEAP-26782
• article
  https://issues.redhat.com/browse/JBEAP-26815
• article
  https://issues.redhat.com/browse/JBEAP-26824
• article
  https://issues.redhat.com/browse/JBEAP-26828
• article
  https://issues.redhat.com/browse/JBEAP-26922
• article
  https://issues.redhat.com/browse/JBEAP-26944
• article
  https://issues.redhat.com/browse/JBEAP-26959
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3559.json
• report
  https://access.redhat.com/security/cve/CVE-2021-23445
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23445
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23445
• article
  https://cdn.datatables.net/1.11.3/
• report
  https://access.redhat.com/security/cve/CVE-2024-1233
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1233
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1233
• advisory
  https://github.com/advisories/GHSA-v4mm-q8fv-r2w5
• article
  https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523
• article
  https://issues.redhat.com/browse/WFLY-19226
• report
  https://access.redhat.com/security/cve/CVE-2024-28752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28752
• article
  https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
• advisory
  https://github.com/advisories/GHSA-qmgx-j96g-4428