Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update

Fixed packages 56

Vulnerabilities 5

• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 1.x Apache Commons BeanUtils 2.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 8.7
  CVE-2025-27611

  base-x homograph attack allows Unicode lookalike characters to bypass validation.

  base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This …

  cryptocoinjs base-x base-x npm
  Apr 30, 2025
• Medium 6.2
  CVE-2025-2251

  Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution

  A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  Apr 7, 2025
• Medium 5.9
  CVE-2025-23184

  Apache CXF: Denial of Service vulnerability with temporary files

  A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies …

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Jan 21, 2025
• Medium 4.6
  CVE-2025-2901 Rejected

  HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

  This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.

  org.jboss.hal:hal-console Maven
  Mar 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0
• article
  https://access.redhat.com/articles/7120566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2339095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2355685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2368956
• article
  https://issues.redhat.com/browse/JBEAP-28866
• article
  https://issues.redhat.com/browse/JBEAP-28992
• article
  https://issues.redhat.com/browse/JBEAP-29253
• article
  https://issues.redhat.com/browse/JBEAP-29257
• article
  https://issues.redhat.com/browse/JBEAP-29530
• article
  https://issues.redhat.com/browse/JBEAP-29679
• article
  https://issues.redhat.com/browse/JBEAP-29691
• article
  https://issues.redhat.com/browse/JBEAP-29692
• article
  https://issues.redhat.com/browse/JBEAP-29806
• article
  https://issues.redhat.com/browse/JBEAP-29863
• article
  https://issues.redhat.com/browse/JBEAP-29867
• article
  https://issues.redhat.com/browse/JBEAP-29984
• article
  https://issues.redhat.com/browse/JBEAP-29999
• article
  https://issues.redhat.com/browse/JBEAP-30087
• article
  https://issues.redhat.com/browse/JBEAP-30151
• article
  https://issues.redhat.com/browse/JBEAP-30157
• article
  https://issues.redhat.com/browse/JBEAP-30263
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10453.json
• report
  https://access.redhat.com/security/cve/CVE-2025-2251
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-2251
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-2251
• article
  https://github.com/wildfly/wildfly/pull/18872
• article
  https://github.com/wildfly/wildfly/releases/tag/36.0.0.Final
• article
  https://issues.redhat.com/browse/WFLY-20550
• report
  https://access.redhat.com/security/cve/CVE-2025-2901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-2901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-2901
• report
  https://access.redhat.com/security/cve/CVE-2025-23184
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-23184
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-23184
• article
  https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122