Skip to content
OpenAdvisories
High WID-SEC-2023-1272 6 CVEs

Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Published Mar 16, 2021 · Updated Jan 7, 2025 · Revision 15 · de-DE

Vendor: Hitachi Vendor: Red Hat Vendor: Splunk Product: Enterprise Product: Enterprise Linux Product: JBoss Enterprise Application Platform Product: Ops Center Platform: Linux

Summary

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial-of-Service-Zustand auslösen, Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Cross-Site-Scripting-Angriff durchführen.

Product

JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.

Vulnerabilities 6

  • High 8.1
    CVE-2020-28052 Public exploit

    Logic error in Legion of the Bouncy Castle BC Java

    An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…

    bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on org.bouncycastle:bcprov-jdk15 Debian Maven
  • High 7.5
    CVE-2020-35510

    Uncontrolled Resource Consumption in jboss-remoting

    A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client reque…

    org.jboss.remoting:jboss-remoting Maven
  • Medium 4.8
    CVE-2020-10687

    HTTP Request Smuggling in Undertow

    A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker …

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 4.8
    CVE-2021-20220

    HTTP request smuggling in Undertow

    A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker t…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 4.3
    CVE-2021-20250

    JBoss EJB Client information disclosure vulnerability

    A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

    org.jboss:jboss-ejb-client Maven
  • Low 3.3
    CVE-2020-8908

    Temp directory permission issue in Guava

    A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on un…

    Google Guava druid celeborn-0.6 Debian Ubuntu Azure Linux Wolfi Maven

Revision history

  1. #15

    Neue Updates von Splunk aufgenommen

  2. #14

    Neue Updates von Red Hat aufgenommen

  3. #13

    Neue Updates von HITACHI aufgenommen

  4. #12

    Neue Updates von HITACHI aufgenommen

  5. #11

    Neue Updates von Red Hat aufgenommen

  6. #10

    Neue Updates von Red Hat aufgenommen

  7. #9

    Neue Updates von Red Hat aufgenommen

  8. #8

    Neue Updates von Red Hat aufgenommen

  9. #7

    Neue Updates von Red Hat aufgenommen

  10. #6

    Neue Updates von HITACHI aufgenommen

  11. #5

    Neue Updates von Red Hat aufgenommen

  12. #4

    Neue Updates von Red Hat aufgenommen

  13. #3

    Neue Updates von Red Hat aufgenommen

  14. #2

    Neue Updates von Red Hat aufgenommen

  15. #1

    Initiale Fassung

References