Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.15 security update

Fixed packages 33

Vulnerabilities 5

• Critical 9.1
  CVE-2024-51127

  hornetq vulnerable to file overwrite, sensitive information disclosure

  An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.

  org.hornetq:hornetq-core-client Maven
  Nov 4, 2024
• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.5
  CVE-2024-27316 Public exploit EPSS 89%

  Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

  HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024
• High 7.5
  CVE-2024-7885

  Undertow: improper state management in proxy protocol parsing causes information leakage

  A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a res…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Aug 21, 2024
• Unscored —
  CVE-2024-4109 Rejected

  Red Hat Product Security has determined that this CVE is not a security vulnerability.

  Dec 12, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2368956
• article
  https://issues.redhat.com/browse/JBEAP-30314
• article
  https://issues.redhat.com/browse/JBEAP-30413
• article
  https://issues.redhat.com/browse/JBEAP-30483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16667.json
• report
  https://access.redhat.com/security/cve/CVE-2024-4109
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4109
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4109
• article
  https://github.com/undertow-io/undertow/pull/1668#
• report
  https://access.redhat.com/security/cve/CVE-2024-7885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-7885
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-7885
• report
  https://access.redhat.com/security/cve/CVE-2024-27316
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27316
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27316
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-51127
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-51127
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-51127
• article
  http://hornetq.com
• article
  https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md
• report
  https://access.redhat.com/security/cve/CVE-2025-48734
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48734
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48734
• advisory
  https://github.com/advisories/GHSA-wxr5-93ph-8wr9
• article
  https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc
• article
  https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9
• article
  https://www.openwall.com/lists/oss-security/2025/05/28/6