Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update

Fixed packages 80

Vulnerabilities 7

• High 7.7
  CVE-2024-8698 Public exploit Scanner template

  Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

  A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024
• High 7.5
  CVE-2022-34169 Public exploit EPSS 82%

  Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

  Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  Jul 19, 2022
• High 7.5
  CVE-2023-52428

  Denial of Service in Connect2id Nimbus JOSE+JWT

  In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

  druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven
  Feb 11, 2024
• Medium 6.1
  CVE-2024-8883 Scanner template

  Keycloak: vulnerable redirect uri validation results in open redirec

  A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be ex…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024
• Medium 5.3
  CVE-2024-41172

  Apache CXF: Unrestricted memory consumption in CXF HTTP clients

  In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventua…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-http Maven
  Jul 19, 2024
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024
• Medium 4.1
  CVE-2024-4029

  Wildfly: no timeout for eap management interface may lead to denial of service (dos)

  A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maxim…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Maven
  May 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2108554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309764
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2311641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312511
• article
  https://issues.redhat.com/browse/JBEAP-24945
• article
  https://issues.redhat.com/browse/JBEAP-25035
• article
  https://issues.redhat.com/browse/JBEAP-27002
• article
  https://issues.redhat.com/browse/JBEAP-27194
• article
  https://issues.redhat.com/browse/JBEAP-27248
• article
  https://issues.redhat.com/browse/JBEAP-27276
• article
  https://issues.redhat.com/browse/JBEAP-27293
• article
  https://issues.redhat.com/browse/JBEAP-27392
• article
  https://issues.redhat.com/browse/JBEAP-27543
• article
  https://issues.redhat.com/browse/JBEAP-27585
• article
  https://issues.redhat.com/browse/JBEAP-27643
• article
  https://issues.redhat.com/browse/JBEAP-27659
• article
  https://issues.redhat.com/browse/JBEAP-27688
• article
  https://issues.redhat.com/browse/JBEAP-27694
• article
  https://issues.redhat.com/browse/JBEAP-27957
• article
  https://issues.redhat.com/browse/JBEAP-28057
• article
  https://issues.redhat.com/browse/JBEAP-28278
• article
  https://issues.redhat.com/browse/JBEAP-28289
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8824.json
• report
  https://access.redhat.com/security/cve/CVE-2022-34169
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-34169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-34169
• report
  https://access.redhat.com/security/cve/CVE-2023-52428
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52428
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52428
• report
  https://access.redhat.com/security/cve/CVE-2024-4029
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4029
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4029
• advisory
  https://github.com/advisories/GHSA-x7g6-rwhc-g7mj
• article
  https://github.com/wildfly/wildfly/pull/17914
• article
  https://github.com/wildfly/wildfly/pull/17935