Skip to content
OpenAdvisories
High RHSA-2025:4548 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Published May 7, 2025 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 29

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-apache-commons-io 0:2.16.1-1.redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-hal-console 0:3.3.26-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-common-api 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-common-impl 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-common-spi 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-core-api 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-core-impl 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-deployers-common 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-jdbc 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-ironjacamar-validator 0:1.5.19-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jboss-remoting 0:5.0.31-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jboss-server-migration 0:1.10.0-41.Final_redhat_00041.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jboss-server-migration-cli 0:1.10.0-41.Final_redhat_00041.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-jboss-server-migration-core 0:1.10.0-41.Final_redhat_00041.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-core 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-core-impl 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-core-jsf 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-ejb 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-jta 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-probe-core 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-weld-web 0:3.1.11-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly 0:7.4.22-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-elytron 0:1.15.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-elytron-tool 0:1.15.25-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-java-jdk11 0:7.4.22-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-java-jdk8 0:7.4.22-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-javadocs 0:7.4.22-2.GA_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.4::el7 eap7-wildfly-modules 0:7.4.22-2.GA_redhat_00001.1.el7eap

Vulnerabilities 4

  • High 7.5
    CVE-2025-24970

    SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

    Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of suc…

    netty netty druid thingsboard-tb-node Ubuntu Wolfi Maven
  • Medium 5.5
    CVE-2024-47535

    Denial of Service attack on windows app using Netty

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on a…

    netty netty netty sonarqube Ubuntu Wolfi Maven
  • Medium 5.5
    CVE-2025-25193

    Denial of Service attack on windows app using Netty

    Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows applic…

    netty netty netty celeborn-0.6 Ubuntu Wolfi Maven
  • Medium 4.3
    CVE-2024-47554

    Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

    Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

    Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2325538
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2337620
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2344787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2344788
  • article
    https://issues.redhat.com/browse/JBEAP-28786
  • article
    https://issues.redhat.com/browse/JBEAP-28808
  • article
    https://issues.redhat.com/browse/JBEAP-28843
  • article
    https://issues.redhat.com/browse/JBEAP-28989
  • article
    https://issues.redhat.com/browse/JBEAP-29003
  • article
    https://issues.redhat.com/browse/JBEAP-29311
  • article
    https://issues.redhat.com/browse/JBEAP-29488
  • article
    https://issues.redhat.com/browse/JBEAP-29539
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4548.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-47535
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47535
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47535
  • article
    https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3
  • article
    https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
  • report
    https://access.redhat.com/security/cve/CVE-2024-47554
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2316271
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47554
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47554
  • article
    https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
  • report
    https://access.redhat.com/security/cve/CVE-2025-24970
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-24970
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-24970
  • article
    https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
  • article
    https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
  • report
    https://access.redhat.com/security/cve/CVE-2025-25193
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-25193
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-25193
  • article
    https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386
  • article
    https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx