Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update

Fixed packages 43

Vulnerabilities 14

• Critical 9.8
  CVE-2022-4492

  Undertow client not checking server identity presented by server certificate in https connections

  The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Feb 23, 2023
• High 7.5
  CVE-2020-36518 Public exploit

  Deeply nested json in jackson-databind

  jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 11, 2022
• High 7.5
  CVE-2021-37136

  Bzip2Decoder doesn't allow setting size restrictions for decompressed data

  The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…

  The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  Oct 19, 2021
• High 7.5
  CVE-2021-37137

  SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

  The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…

  The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  Oct 19, 2021
• High 7.5
  CVE-2022-2053

  Undertow vulnerable to Dos via Large AJP request

  When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a fron…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Aug 5, 2022
• High 7.5
  CVE-2023-1108

  Undertow: infinite loop in sslconduit during close

  A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Sep 14, 2023
• High 7.5
  CVE-2023-1973

  Undertow: unrestricted request storage leads to memory exhaustion

  A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

  Red Hat Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Debian Ubuntu Maven
  Nov 7, 2024
• High 7.5
  CVE-2023-3223

  Undertow: outofmemoryerror due to @multipartconfig handling

  A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 RHEL-8 based Middleware Containers Debian Ubuntu Maven
  Sep 27, 2023
• High 7.5
  CVE-2023-5379

  Undertow: ajp request closes connection exceeding maxrequestsize

  A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP respons…

  Red Hat Red Hat Single Sign-On 7 Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Debian Ubuntu
  Dec 12, 2023
• High 7.5
  CVE-2024-1635

  Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

  A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Debian Ubuntu Maven
  Feb 19, 2024
• High 7.4
  CVE-2022-3143

  Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator

  wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.…

  redhat.com Wildfly-elytron org.wildfly.security:wildfly-elytron Maven
  Jan 11, 2023
• High 7.3
  CVE-2024-1233

  Eap: wildfly-elytron has a ssrf security issue

  A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a serv…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Maven
  Apr 9, 2024
• Unscored —
  CVE-2022-1259

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause …

  undertow Ubuntu
  Aug 31, 2022
• Unscored —
  CVE-2022-1319

  A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those pack…

  undertow undertow Debian Ubuntu
  Aug 31, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2004133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2004135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064698
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073890
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2095862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124682
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2174246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185662
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2209689
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262849
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2264928
• article
  https://issues.redhat.com/browse/JBEAP-29448
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9583.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36518
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36518
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36518
• advisory
  https://github.com/advisories/GHSA-57j2-w4cx-62h2
• report
  https://access.redhat.com/security/cve/CVE-2021-37136
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37136
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37136
• article
  https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
• report
  https://access.redhat.com/security/cve/CVE-2021-37137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37137
• report
  https://access.redhat.com/security/cve/CVE-2022-1259
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1259
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1259
• report
  https://access.redhat.com/security/cve/CVE-2022-1319
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1319
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1319
• report
  https://access.redhat.com/security/cve/CVE-2022-2053