Description
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | EAP 7.4.14 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.21.0-4.redhat_00048.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-amazon-ion-java | 1.0.2-4.redhat_00005.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.2-3.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-antlr4 +1 | 4.10.1-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-beanutils | 1.9.4-12.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-codec | 1.15.0-5.redhat_00015.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-io | 2.11.0-2.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.0-2.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-apache-sshd | 2.12.1-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-atinject +1 | 2.0.1-2.redhat_00005.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-caffeine | 3.1.8-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-elytron-web | 4.0.1-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-fge-btf | 1.2.0-2.redhat_00017.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-fge-msg-simple | 1.1.0-2.redhat_00015.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-gson | 2.8.9-2.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 32.1.2-1.jre_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.1-4.redhat_00012.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.6.18-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.18-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 6.2.2-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-hibernate-validator +1 | 8.0.1-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-asyncclient | 4.1.5-2.redhat_00004.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-client | 4.5.14-2.redhat_00010.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-core | 4.4.16-2.redhat_00008.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-infinispan +20 | 14.0.24-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-ironjacamar +8 | 3.0.8-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jackson-core +12 | 2.15.4-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.2-2.redhat_00005.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-annotation-api | 2.1.1-4.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-batch-api | 2.1.1-3.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-interceptor-api | 2.1.0-4.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-jms-api | 3.1.0-4.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-json | 1.1.6-4.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-json-api | 2.1.2-3.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-mail | 2.1.2-2.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-servlet-api | 6.0.0-4.redhat_00005.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-transaction-api | 2.0.1-3.redhat_00004.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-validation-api | 3.0.2-2.redhat_00005.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-ws-rs-api | 3.1.0-4.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jakarta-xml-bind-api | 4.0.0-4.redhat_00009.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jasypt | 1.9.3-3.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-java-classmate | 1.5.1-2.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-javaee-jpa-spec | 3.1.0-3.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jaxb +9 | 4.0.2-4.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jberet +1 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jboss-cert-helper +1 | 1.1.2-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jboss-ejb-client | 5.0.6-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jboss-modules | 2.1.4-2.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jgroups | 5.2.23-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jgroups-kubernetes | 2.0.2-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-joda-time | 2.12.5-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-jose4j | 0.9.3-2.redhat_00004.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-log4j2-jboss-logmanager | 1.1.2-1.Final_redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-lucene-core +6 | 8.11.3-1.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.2-1.Final_redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-netty +13 | 4.1.100-2.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-netty-transport-native-epoll | 4.1.100-5.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-protostream | 4.6.5-4.Final_redhat_00006.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-reactive-streams | 1.0.4-2.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-resteasy +15 | 6.2.7-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.7-3.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-snakeyaml | 2.0.0-2.redhat_00012.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-stax2-api | 4.2.1-2.redhat_00008.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-sun-istack-commons +2 | 4.1.2-1.redhat_00003.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-velocity +1 | 2.3.0-2.redhat_00008.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.0.2-2.GA_redhat_00009.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.2.4-2.SP01_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.0.7-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wildfly-transaction-client | 3.0.5-1.Final_redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-woodstox-core | 6.4.0-2.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-ws-commons-XmlSchema | 2.3.0-2.redhat_00002.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wsdl4j | 1.6.3-4.redhat_00007.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-wss4j +6 | 3.0.1-2.redhat_00014.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.3-2.redhat_00001.1.el8eap | RHSA-2024:3581, RHSA-2024:3580 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-17.redhat_00051.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.3-1.redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-avro | 1.11.3-1.redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 32.1.1-2.jre_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.20-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.32-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.18-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.4.4-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.1-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.14-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-33.Final_redhat_00032.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.11-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.9-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.2.23-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.28-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.10-2.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.14-5.GA_redhat_00002.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.14-5.GA_redhat_00002.1.el8eap | RHSA-2023:7639, RHSA-2023:7638 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.11-4.redhat_00002.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
Advisories 6
- RHSA-2023:7639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:3580 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.2 Security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2024:3581 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.2 Security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2024-1286 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 24, 2025
References
- RHSA-2023:7637 vendor-advisory
- RHSA-2023:7638 vendor-advisory
- RHSA-2023:7639 vendor-advisory
- RHSA-2023:7641 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-4503 vdb-entry
- RHBZ#2184751 issue-tracking