WID-SEC-2023-3224 — Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in der Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.

Vulnerabilities 1

High 7.5

CVE-2023-3171

Eap-7: heap exhaustion via deserialization

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could ev…

Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Dec 27, 2023

Revision history

2024-11-24 #2
Neue Updates von Red Hat aufgenommen
2023-12-27 #1
Initiale Fassung

References

Github Advisory - JBoss vom 2023-12-27
https://github.com/advisories/GHSA-gpgq-5q34-mh72
Red Hat Security Advisory - JBoss vom 2023-12-27
https://access.redhat.com/security/cve/CVE-2023-3171
Red Hat Security Advisory - JBoss vom 2023-12-27
https://access.redhat.com/errata/RHSA-2023:5488
Red Hat Security Advisory RHSA-2024:10208 vom 2024-11-25
https://access.redhat.com/errata/RHSA-2024:10208
Red Hat Security Advisory RHSA-2024:10207 vom 2024-11-25
https://access.redhat.com/errata/RHSA-2024:10207