Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.13 security update

Fixed packages 47

Vulnerabilities 8

• High 7.7
  CVE-2022-25647 EPSS 12%

  Deserialization of Untrusted Data

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

  openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  May 1, 2022
• High 7.5
  CVE-2022-0084

  XNIO `notifyReadClosed` method logging message to unexpected end

  A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…

  jboss-xnio jboss-xnio org.jboss.xnio:xnio-all Debian Ubuntu Maven
  Aug 26, 2022
• High 7.5
  CVE-2022-23913

  Apache ActiveMQ Artemis DoS

  In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

  Apache Software Foundation Apache ActiveMQ Artemis org.apache.activemq:artemis-core-client Maven
  Feb 4, 2022
• High 7.5
  CVE-2022-24785 Public exploit EPSS 14%

  Path Traversal in Moment.js

  Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…

  moment moment node-moment node-moment Debian Ubuntu npm NuGet
  Apr 4, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• Medium 6.5
  CVE-2022-40149

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2022-40150

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2022-40152 EPSS 18%

  Stack Buffer Overflow in Woodstox

  Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

  x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven
  Sep 16, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2063601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2080850
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2126789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135770
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135771
• article
  https://issues.redhat.com/browse/JBEAP-29297
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4437.json
• report
  https://access.redhat.com/security/cve/CVE-2022-0084
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0084
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0084
• report
  https://access.redhat.com/security/cve/CVE-2022-23913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23913
• article
  https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2
• report
  https://access.redhat.com/security/cve/CVE-2022-24785
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24785
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24785
• article
  https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
• report
  https://access.redhat.com/security/cve/CVE-2022-25647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25647
• report
  https://access.redhat.com/security/cve/CVE-2022-25857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25857
• article
  https://bitbucket.org/snakeyaml/snakeyaml/issues/525
• report
  https://access.redhat.com/security/cve/CVE-2022-40149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40149
• article
  https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
• report
  https://access.redhat.com/security/cve/CVE-2022-40150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40150