Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update

Fixed packages 41

Vulnerabilities 13

• Critical 10.0
  CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 10, 2021

  KEV Dec 10, 2021
• Critical 9.0
  CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 14, 2021

  KEV May 1, 2023
• Critical 9.8
  CVE-2021-42392 Public exploit Scanner template EPSS 83%

  RCE in H2 Console

  The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

  h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  Jan 7, 2022
• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery node-minimist node-minimist minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• Critical 9.8
  CVE-2022-45047 Public exploit

  Apache MINA SSHD: Java unsafe deserialization vulnerability

  Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-common org.apache.sshd:sshd-core Maven
  Nov 16, 2022
• High 8.8
  CVE-2020-13936 EPSS 23%

  Velocity Sandbox Bypass

  An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…

  Apache Software Foundation Apache Velocity Engine velocity org.apache.velocity:velocity-engine-parent Debian Ubuntu Maven
  Mar 10, 2021
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-42004

  Uncontrolled Resource Consumption in FasterXML jackson-databind

  In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-45693

  Jettison Out-of-bounds Write vulnerability

  Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

  druid libjettison-java libjettison-java org.codehaus.jettison:jettison Debian Ubuntu Wolfi Maven
  Dec 13, 2022
• High 7.5
  CVE-2022-46363

  Apache CXF directory listing / code exfiltration

  A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-que…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Dec 13, 2022
• Medium 5.3
  CVE-2022-41881

  HAProxyMessageDecoder Stack Exhaustion DoS

  Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

  netty netty netty netty Debian Ubuntu Maven
  Dec 12, 2022

References

• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1937440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030932
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2032580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135244
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2145194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2155681
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2155970
• article
  https://issues.redhat.com/browse/JBEAP-28581
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1747.json
• report
  https://access.redhat.com/security/cve/CVE-2020-13936
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-13936
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-13936
• report
  https://access.redhat.com/security/cve/CVE-2021-42392
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-42392
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-42392
• article
  https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6
• article
  https://access.redhat.com/security/cve/CVE-2021-44228
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44228
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• advisory
  https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
• article
  https://logging.apache.org/log4j/2.x/security.html
• article
  https://www.lunasec.io/docs/blog/log4j-zero-day/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2021-45046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-45046