Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update

Fixed packages 10

Vulnerabilities 6

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Critical 9.1
  CVE-2024-51127

  hornetq vulnerable to file overwrite, sensitive information disclosure

  An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.

  org.hornetq:hornetq-core-client Maven
  Nov 4, 2024
• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.5
  CVE-2020-10705

  Allocation of Resources Without Limits or Throttling in Undertow

  A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Jun 10, 2020
• High 7.5
  CVE-2024-27316 Public exploit EPSS 89%

  Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

  HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024
• Unscored —
  CVE-2024-4109 Rejected

  Red Hat Product Security has determined that this CVE is not a security vulnerability.

  Dec 12, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1803241
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2368956
• article
  https://issues.redhat.com/browse/JBEAP-30484
• article
  https://issues.redhat.com/browse/JBEAP-30522
• article
  https://issues.redhat.com/browse/JBEAP-30523
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16668.json
• report
  https://access.redhat.com/security/cve/CVE-2020-10705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10705
• report
  https://access.redhat.com/security/cve/CVE-2023-44487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-44487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-44487
• article
  https://github.com/dotnet/announcements/issues/277
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• article
  https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2024-4109
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4109
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4109
• article
  https://github.com/undertow-io/undertow/pull/1668#
• report
  https://access.redhat.com/security/cve/CVE-2024-27316
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27316
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27316
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-51127
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-51127
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-51127
• article
  http://hornetq.com