Skip to content
OpenAdvisories
Critical RHSA-2024:5856 21 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update

Published Sep 29, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-apache-commons-beanutils 0:1.9.4-1.redhat_00002.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan-cachestore-jdbc 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan-cachestore-remote 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan-client-hotrod 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan-commons 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-infinispan-core 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-jackson-databind 0:2.8.11.5-1.redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-log4j-jboss-logmanager 0:1.2.2-1.Final_redhat_00002.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-netty 0:4.1.45-1.Final_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-netty-all 0:4.1.45-1.Final_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-undertow 0:1.4.18-12.SP12_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-wildfly 0:7.1.7-2.GA_redhat_00002.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-wildfly-elytron 0:1.1.13-1.Final_redhat_00001.1.ep7.el7
Red Hat · Jboss Enterprise Application Platform Eus 7 jboss_enterprise_application_platform_eus:7.1::el7 eap7-wildfly-modules 0:7.1.7-2.GA_redhat_00002.1.ep7.el7

Vulnerabilities 21

  • Critical 9.8
    CVE-2019-14379

    Deserialization of untrusted data in FasterXML jackson-databind

    SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2019-17531

    jackson-databind polymorphic typing issue

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (versi…

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-23305 Public exploit EPSS 67%

    SQL injection in JDBC Appender in Apache Log4j V1

    By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • Critical 9.1
    CVE-2019-20444

    HTTP Request Smuggling in Netty

    HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

    druid netty netty io.netty:netty-codec-http Debian Ubuntu Wolfi Maven
  • High 8.8
    CVE-2022-23302 EPSS 64%

    Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

    JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Top…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • High 8.8
    CVE-2022-23307 EPSS 54%

    A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

    CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • High 8.6
    CVE-2020-1745

    Improper Authorization in Undertoe

    A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability …

    undertow-io undertow undertow undertow Debian Ubuntu Maven
  • High 8.1
    CVE-2020-1757

    Improper Input Validation in Undertow

    A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path afte…

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • High 7.5
    CVE-2019-10174

    Use of Externally-Controlled Input to Select Classes or Code in Infinispan

    A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce n…

    [UNKNOWN] infinispan org.infinispan:infinispan-core Maven
  • High 7.5
    CVE-2019-14843

    A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. Th…

    Red Hat wildfly-security-manager
  • High 7.5
    CVE-2019-14888

    Undertow vulnerable to Uncontrolled Resource Consumption

    A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • High 7.5
    CVE-2019-16869

    HTTP Request Smuggling in Netty

    Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

    druid netty netty io.netty:netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9512 EPSS 83%

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…

    go stdlib golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2019-9514 EPSS 83%

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depe…

    nodejs go golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2019-9515 EPSS 87%

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an …

    nodejs trafficserver netty trafficserver Debian Ubuntu Alpine
  • High 7.5
    CVE-2021-4104 Public exploit EPSS 81%

    Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • High 7.3
    CVE-2019-10086 EPSS 29%

    Insecure Deserialization in Apache Commons Beanutils

    In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

    Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2019-12384 Public exploit EPSS 45%

    Deserialization of Untrusted Data in FasterXML jackson-databind

    FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

    jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  • Medium —
    CVE-2019-20445 EPSS 14%

    HTTP Request Smuggling in Netty

    HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

    druid netty netty io.netty:netty-handler Debian Ubuntu Wolfi Maven
  • Unscored —
    CVE-2020-1710

    The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1703469
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1725807
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735645
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735744
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735745
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1737517
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741860
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752770
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752980
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1758619
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1767483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1772464
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1775293
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793970
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1798509
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1798524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1807305
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031667
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2041949
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2041959
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2041967
  • article
    https://issues.redhat.com/browse/JBEAP-24826
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5856.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-9511
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9511
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9511
  • article
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  • article
    https://kb.cert.org/vuls/id/605641/
  • article
    https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
  • article
    https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
  • report
    https://access.redhat.com/security/cve/CVE-2019-9512
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9512
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9512
  • article
    https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg
  • article
    https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA
  • article
    https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html