Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update

Fixed packages 29

Vulnerabilities 18

• Critical 10.0
  CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 10, 2021

  KEV Dec 10, 2021
• Critical 9.0
  CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 14, 2021

  KEV May 1, 2023
• Critical 9.8
  CVE-2020-8840 Public exploit EPSS 27%

  Deserialization of Untrusted Data in jackson-databind

  FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Feb 10, 2020
• Critical 9.8
  CVE-2020-9546

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9547 Public exploit Scanner template EPSS 18%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2020-9548 Public exploit Scanner template EPSS 19%

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• Critical 9.8
  CVE-2022-45047 Public exploit

  Apache MINA SSHD: Java unsafe deserialization vulnerability

  Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-common org.apache.sshd:sshd-core Maven
  Nov 16, 2022
• High 8.8
  CVE-2020-10672

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 18, 2020
• High 8.8
  CVE-2020-10673 Public exploit

  jackson-databind mishandles the interaction between serialization gadgets and typing

  FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 18, 2020
• High 8.8
  CVE-2020-13936 EPSS 23%

  Velocity Sandbox Bypass

  An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…

  Apache Software Foundation Apache Velocity Engine org.apache.velocity:velocity velocity Debian Ubuntu Maven
  Mar 10, 2021
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 7.8
  CVE-2021-3717

  Wildfly-Core user account mismanagement

  A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…

  org.wildfly.core:wildfly-core-parent Maven
  May 24, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-42004

  Uncontrolled Resource Consumption in FasterXML jackson-databind

  In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-45693

  Jettison Out-of-bounds Write vulnerability

  Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

  druid libjettison-java libjettison-java org.codehaus.jettison:jettison Debian Ubuntu Wolfi Maven
  Dec 13, 2022
• High 7.5
  CVE-2022-46363

  Apache CXF directory listing / code exfiltration

  A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-que…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Dec 13, 2022
• Medium 5.3
  CVE-2022-41881

  HAProxyMessageDecoder Stack Exhaustion DoS

  Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

  netty netty netty netty Debian Ubuntu Maven
  Dec 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1815470
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1815495
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1937440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030932
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2032580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135244
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2145194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2155681
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2155970
• article
  https://issues.redhat.com/browse/JBEAP-28583
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1746.json
• report
  https://access.redhat.com/security/cve/CVE-2020-8840
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8840
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8840
• report
  https://access.redhat.com/security/cve/CVE-2020-9546
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-9546
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-9546
• report
  https://access.redhat.com/security/cve/CVE-2020-9547
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-9547
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-9547
• report
  https://access.redhat.com/security/cve/CVE-2020-9548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-9548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-9548
• report
  https://access.redhat.com/security/cve/CVE-2020-10672
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10672
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10672
• report
  https://access.redhat.com/security/cve/CVE-2020-10673