Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.
Product
JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.
Vulnerabilities 3
-
High 7.5
Undertow: unrestricted request storage leads to memory exhaustion
A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.
-
High 7.4
Undertow: cookie smuggling/spoofing
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional coo…
-
Medium 5.3
Undertow: directory traversal vulnerability
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and dire…
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Security Advisory RHSA-2024:2763 vom 2024-05-09
https://access.redhat.com/errata/RHSA-2024:2763
-
Red Hat Security Advisory RHSA-2024:2764 vom 2024-05-09
https://access.redhat.com/errata/RHSA-2024:2764
-
RedHat Security Advisory
https://access.redhat.com/errata/RHSA-2024:3919
-
Red Hat Security Advisory RHSA-2025:9583 vom 2025-06-25
https://access.redhat.com/errata/RHSA-2025:9583