Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update

Fixed packages 28

Vulnerabilities 5

• High 7.5
  CVE-2022-34169 Public exploit EPSS 82%

  Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

  Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  Jul 19, 2022
• High 7.5
  CVE-2024-4068

  Memory Exhaustion in braces

  The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which wi…

  micromatch braces lerna kubeflow-pipelines-frontend Debian Ubuntu Azure Linux Wolfi npm
  May 13, 2024
• Medium 6.5
  CVE-2023-51775

  jose4j denial of service via specifically crafted JWE

  The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

  confluent-kafka confluent-common-docker org.bitbucket.b_c:jose4j libjose4j-java Debian Ubuntu Wolfi Maven
  Dec 25, 2023
• Medium 6.1
  CVE-2022-36033

  jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled

  jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that l…

  jhy jsoup org.jsoup:jsoup jsoup Debian Ubuntu Azure Linux Maven
  Aug 29, 2022
• Medium 4.1
  CVE-2024-4029

  Wildfly: no timeout for eap management interface may lead to denial of service (dos)

  A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maxim…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Maven
  May 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2108554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2127078
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280600
• article
  https://issues.redhat.com/browse/JBEAP-27050
• article
  https://issues.redhat.com/browse/JBEAP-27357
• article
  https://issues.redhat.com/browse/JBEAP-27548
• article
  https://issues.redhat.com/browse/JBEAP-27613
• article
  https://issues.redhat.com/browse/JBEAP-27658
• article
  https://issues.redhat.com/browse/JBEAP-27700
• article
  https://issues.redhat.com/browse/JBEAP-27701
• article
  https://issues.redhat.com/browse/JBEAP-27713
• article
  https://issues.redhat.com/browse/JBEAP-27714
• article
  https://issues.redhat.com/browse/JBEAP-27715
• article
  https://issues.redhat.com/browse/JBEAP-27746
• article
  https://issues.redhat.com/browse/JBEAP-27747
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8076.json
• report
  https://access.redhat.com/security/cve/CVE-2022-34169
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-34169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-34169
• report
  https://access.redhat.com/security/cve/CVE-2022-36033
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-36033
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-36033
• report
  https://access.redhat.com/security/cve/CVE-2023-51775
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-51775
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-51775
• report
  https://access.redhat.com/security/cve/CVE-2024-4029
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4029
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4029
• advisory
  https://github.com/advisories/GHSA-x7g6-rwhc-g7mj
• article
  https://github.com/wildfly/wildfly/pull/17914
• article
  https://github.com/wildfly/wildfly/pull/17935
• report
  https://access.redhat.com/security/cve/CVE-2024-4068
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4068
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4068