Description
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | EAP 7.4.13 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-3.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-2.redhat_00003.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-2.redhat_00005.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.10-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-2.Final_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.8-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-26.redhat_00015.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.2.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-15.redhat_00049.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +5 | 1.76.0-4.redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.19-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.31-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.15-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.13-2.SP1_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.12.2-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-31.Final_redhat_00030.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.5-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.94-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-resteasy +18 | 3.15.8-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.26-1.SP1_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.13-8.GA_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.20-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.13-8.GA_redhat_00001.1.el8eap | RHSA-2023:5486, RHSA-2023:5485 |
Advisories 6
- RHSA-2024:10208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:5486 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:5484 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:5485 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2023-3224 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 24, 2024
References
- RHSA-2023:5484 vendor-advisory
- RHSA-2023:5485 vendor-advisory
- RHSA-2023:5486 vendor-advisory
- RHSA-2023:5488 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3171 vdb-entry
- RHBZ#2213639 issue-tracking