Action not permitted
Modal body text goes here.
cve-2023-33201
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T15:39:35.708Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://bouncycastle.org" }, { "tags": [ "x_transferred" ], "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc" }, { "tags": [ "x_transferred" ], "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20230824-0008/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2023-08-24T18:06:18.676012", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://bouncycastle.org" }, { "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc" }, { "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "url": "https://security.netapp.com/advisory/ntap-20230824-0008/" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2023-33201", "datePublished": "2023-07-05T00:00:00", "dateReserved": "2023-05-18T00:00:00", "dateUpdated": "2024-08-02T15:39:35.708Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-33201\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-07-05T03:15:09.197\",\"lastModified\":\"2023-08-24T19:15:38.933\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.74\",\"matchCriteriaId\":\"93E9273D-E54C-43EF-8822-39FA3C2834E0\"}]}]}],\"references\":[{\"url\":\"https://bouncycastle.org\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE-2023-33201\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20230824-0008/\",\"source\":\"cve@mitre.org\"}]}}" } }
rhsa-2024_0278
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat AMQ Broker 7.11.5 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.\n\nThis release of Red Hat AMQ Broker 7.11.5 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* (CVE-2023-33201) bouncycastle: potential blind LDAP injection attack using a self-signed certificate\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0278", "url": "https://access.redhat.com/errata/RHSA-2024:0278" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.11.5", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.11.5" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_amq_broker/7.11", "url": "https://access.redhat.com/documentation/en-us/red_hat_amq_broker/7.11" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0278.json" } ], "title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.11.5 release and security update", "tracking": { "current_release_date": "2024-11-06T04:44:51+00:00", "generator": { "date": "2024-11-06T04:44:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:0278", "initial_release_date": "2024-01-17T13:23:10+00:00", "revision_history": [ { "date": "2024-01-17T13:23:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-01-17T13:23:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:44:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AMQ Broker 7.11.5", "product": { "name": "AMQ Broker 7.11.5", "product_id": "AMQ Broker 7.11.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_broker:7.11" } } } ], "category": "product_family", "name": "Red Hat JBoss AMQ" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AMQ Broker 7.11.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-01-17T13:23:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "AMQ Broker 7.11.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0278" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AMQ Broker 7.11.5" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" } ] }
rhsa-2023_5147
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat Integration Camel for Spring Boot 3.18.3.2 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "A security update for Camel for Spring Boot 3.18.3.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\n* spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry (CVE-2023-20873)\n\n* jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* snappy-java: Unchecked chunk length leads to DoS (CVE-2023-34455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5147", "url": "https://access.redhat.com/errata/RHSA-2023:5147" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2023-Q3", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2023-Q3" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2185707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185707" }, { "category": "external", "summary": "2215445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2231491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2231491" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5147.json" } ], "title": "Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3.2 release and security update", "tracking": { "current_release_date": "2024-11-06T03:40:40+00:00", "generator": { "date": "2024-11-06T03:40:40+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5147", "initial_release_date": "2023-09-13T15:40:09+00:00", "revision_history": [ { "date": "2023-09-13T15:40:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-09-13T15:40:09+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:40:40+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHINT Camel-Springboot 3.18.3.2", "product": { "name": "RHINT Camel-Springboot 3.18.3.2", "product_id": "RHINT Camel-Springboot 3.18.3.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_spring_boot:3.18" } } } ], "category": "product_family", "name": "Red Hat Integration" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-46877", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-04-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2185707" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHINT Camel-Springboot 3.18.3.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-46877" }, { "category": "external", "summary": "RHBZ#2185707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-46877", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46877" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-46877", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46877" } ], "release_date": "2023-03-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-13T15:40:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258", "product_ids": [ "RHINT Camel-Springboot 3.18.3.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5147" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHINT Camel-Springboot 3.18.3.2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode" }, { "cve": "CVE-2023-20873", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2023-04-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2231491" } ], "notes": [ { "category": "description", "text": "A flaw was found in Spring Boot. This targets specifically \u0027spring-boot-actuator-autoconfigure\u0027 package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass.\r\n\r\nSpecifically, an application is vulnerable when all of the following are true:\r\n\r\n * You have code that can handle requests that match /cloudfoundryapplication/**. Typically, this will be if there is a catch-all request mapping which matches /**.\r\n * The application is deployed to Cloud Foundry.\r\n\r\nAn application is not vulnerable if any of the following is true:\r\n\r\n * The application is not deployed to Cloud Foundry\r\n * You have disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false.\r\n * Your application does not have handler mappings that can handle requests to /cloudfoundryapplication/**.", "title": "Vulnerability description" }, { "category": "summary", "text": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry", "title": "Vulnerability summary" }, { "category": "other", "text": "The following Red Hat products do not ship the affected software component and so are not affected:\n\n * Red Hat Enterprise Linux 8, 9\n * Enterprise Application Platform 6, 7, 8, XP\n * Data Grid 7, 8\n * Migration Toolkit for Runtimes\n * Red Hat Build of OptaPlanner\n * Red Hat Integration Camel-K\n * Red Hat AMQ Broker 7\n * Red Hat AMQ Clients 2\n * Red Hat AMQ Streams 2\n * Red Hat Fuse 6\n * Red Hat Fuse 7\n * Red Hat VertX 4\n\nThe following Red Hat products ship the affected software but do not enable or do not ship the vulnerable classes, and so are affected but at Low security impact.\n\n * Red Hat Decision Manager 7\n * Red Hat Process Automation Manager 7\n * Red Hat Single Sign-On 7", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHINT Camel-Springboot 3.18.3.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-20873" }, { "category": "external", "summary": "RHBZ#2231491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2231491" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-20873", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20873" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-20873", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20873" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-g5h3-w546-pj7f", "url": "https://github.com/advisories/GHSA-g5h3-w546-pj7f" }, { "category": "external", "summary": "https://spring.io/security/cve-2023-20873/", "url": "https://spring.io/security/cve-2023-20873/" } ], "release_date": "2023-05-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-13T15:40:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258", "product_ids": [ "RHINT Camel-Springboot 3.18.3.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5147" }, { "category": "workaround", "details": "Disable Cloud Foundry actuator endpoints by setting \u0027management.cloudfoundry.enabled\u0027 to false.", "product_ids": [ "RHINT Camel-Springboot 3.18.3.2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "RHINT Camel-Springboot 3.18.3.2" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHINT Camel-Springboot 3.18.3.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-13T15:40:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258", "product_ids": [ "RHINT Camel-Springboot 3.18.3.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5147" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "RHINT Camel-Springboot 3.18.3.2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34455", "cwe": { "id": "CWE-1285", "name": "Improper Validation of Specified Index, Position, or Offset in Input" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215445" } ], "notes": [ { "category": "description", "text": "A flaw was found in Snappy-java\u0027s fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snappy-java: Unchecked chunk length leads to DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHINT Camel-Springboot 3.18.3.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34455" }, { "category": "external", "summary": "RHBZ#2215445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34455", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34455" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-13T15:40:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258", "product_ids": [ "RHINT Camel-Springboot 3.18.3.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5147" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHINT Camel-Springboot 3.18.3.2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snappy-java: Unchecked chunk length leads to DoS" } ] }
rhsa-2023_3954
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A minor version update (from 7.11 to 7.12) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release of Red Hat Fuse 7.12 serves as a replacement for Red Hat Fuse 7.11 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References.\n\nSecurity Fix(es):\n\n* hazelcast: Hazelcast connection caching (CVE-2022-36437)\n\n* spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security (CVE-2022-31692)\n\n* xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow (CVE-2022-41966)\n\n* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)\n\n* Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n\n* Undertow: Infinite loop in SslConduit during close (CVE-2023-1108)\n\n* json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) (CVE-2023-1370)\n\n* springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)\n\n* spring-boot: Spring Boot Welcome Page DoS Vulnerability (CVE-2023-20883)\n\n* jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name (CVE-2012-5783)\n\n* apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)\n\n* undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)\n\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n\n* batik: Server-Side Request Forgery (CVE-2022-38398)\n\n* batik: Server-Side Request Forgery (CVE-2022-38648)\n\n* batik: Server-Side Request Forgery (SSRF) vulnerability (CVE-2022-40146)\n\n* batik: Apache XML Graphics Batik vulnerable to code execution via SVG (CVE-2022-41704)\n\n* dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)\n\n* codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)\n\n* engine.io: Specially crafted HTTP request can trigger an uncaught exception (CVE-2022-41940)\n\n* postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions (CVE-2022-41946)\n\n* batik: Untrusted code execution in Apache XML Graphics Batik (CVE-2022-42890)\n\n* Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n\n* springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)\n\n* shiro: Authentication bypass through a specially crafted HTTP request (CVE-2023-22602)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* tomcat: JsonErrorReportValve injection (CVE-2022-45143)\n\nFor more details about the security issues, including the impact, CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:3954", "url": "https://access.redhat.com/errata/RHSA-2023:3954" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.12.0", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.12.0" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.12/", "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.12/" }, { "category": "external", "summary": "873317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=873317" }, { "category": "external", "summary": "1886587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886587" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "2144970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144970" }, { "category": "external", "summary": "2151988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2151988" }, { "category": "external", "summary": "2153260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260" }, { "category": "external", "summary": "2153379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379" }, { "category": "external", "summary": "2153399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153399" }, { "category": "external", "summary": "2155291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155291" }, { "category": "external", "summary": "2155292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155292" }, { "category": "external", "summary": "2155295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155295" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2158695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158695" }, { "category": "external", "summary": "2162053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162053" }, { "category": "external", "summary": "2162206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162206" }, { "category": "external", "summary": "2170431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170431" }, { "category": "external", "summary": "2174246", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2174246" }, { "category": "external", "summary": "2180528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180528" }, { "category": "external", "summary": "2180530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180530" }, { "category": "external", "summary": "2182182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182182" }, { "category": "external", "summary": "2182183", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182183" }, { "category": "external", "summary": "2182198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182198" }, { "category": "external", "summary": "2188542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542" }, { "category": "external", "summary": "2209342", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209342" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "ENTESB-20598", "url": "https://issues.redhat.com/browse/ENTESB-20598" }, { "category": "external", "summary": "ENTESB-21418", "url": "https://issues.redhat.com/browse/ENTESB-21418" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3954.json" } ], "title": "Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update", "tracking": { "current_release_date": "2024-11-06T03:17:19+00:00", "generator": { "date": "2024-11-06T03:17:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:3954", "initial_release_date": "2023-06-29T20:07:23+00:00", "revision_history": [ { "date": "2023-06-29T20:07:23+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-06-29T20:07:23+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:17:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7.12", "product": { "name": "Red Hat Fuse 7.12", "product_id": "Red Hat Fuse 7.12", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat JBoss Fuse" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2012-5783", "discovery_date": "2012-11-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "873317" } ], "notes": [ { "category": "description", "text": "It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject\u0027s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.", "title": "Vulnerability description" }, { "category": "summary", "text": "jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-5783" }, { "category": "external", "summary": "RHBZ#873317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=873317" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5783", "url": "https://www.cve.org/CVERecord?id=CVE-2012-5783" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5783", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5783" } ], "release_date": "2012-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name" }, { "cve": "CVE-2020-13956", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-10-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1886587" } ], "notes": [ { "category": "description", "text": "Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-httpclient: incorrect handling of malformed authority component in request URIs", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable httpclient library to authenticated users only. Additionally the vulnerable httpclient library is not used directly in OCP components, therefore the impact by this vulnerability is Low.\nIn OCP 4 there are no plans to maintain ose-logging-elasticsearch5 container, hence marked as wontfix.\n\nIn the Red Hat Enterprise Linux platforms, Maven 35 and 36 are affected via their respective `httpcomponents-client` component.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13956" }, { "category": "external", "summary": "RHBZ#1886587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886587" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13956", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13956" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/10/08/4", "url": "https://www.openwall.com/lists/oss-security/2020/10/08/4" } ], "release_date": "2020-10-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-httpclient: incorrect handling of malformed authority component in request URIs" }, { "cve": "CVE-2022-4492", "cwe": { "id": "CWE-550", "name": "Server-generated Error Message Containing Sensitive Information" }, "discovery_date": "2022-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2153260" } ], "notes": [ { "category": "description", "text": "A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2.", "title": "Vulnerability description" }, { "category": "summary", "text": "undertow: Server identity in https connection is not checked by the undertow client", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4492" }, { "category": "external", "summary": "RHBZ#2153260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4492", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4492" } ], "release_date": "2022-12-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "undertow: Server identity in https connection is not checked by the undertow client" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "Red Hat Fuse 7.12" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-31692", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-01-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2162206" } ], "notes": [ { "category": "description", "text": "A flaw was found in the spring-security framework. Spring Security could allow a remote attacker to bypass security restrictions caused by an issue when using forward or include dispatcher types. By sending a specially-crafted request, an attacker can bypass authorization rules.", "title": "Vulnerability description" }, { "category": "summary", "text": "spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31692" }, { "category": "external", "summary": "RHBZ#2162206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162206" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31692", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31692" }, { "category": "external", "summary": "https://spring.io/security/cve-2022-31692", "url": "https://spring.io/security/cve-2022-31692" } ], "release_date": "2022-10-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security" }, { "cve": "CVE-2022-36437", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2023-01-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2162053" } ], "notes": [ { "category": "description", "text": "A flaw was found in Hazelcast and Hazelcast Jet. This flaw may allow an attacker unauthenticated access to manipulate data in the cluster.", "title": "Vulnerability description" }, { "category": "summary", "text": "hazelcast: Hazelcast connection caching", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration - Camel Quarkus Extensions: Hazelcast is contained in camel-quarkus-hazelcast but it does not affect any supported component. This package is community support only. Hence the low impact for Camel Quarkus Extension.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36437" }, { "category": "external", "summary": "RHBZ#2162053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162053" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36437", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36437" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36437", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36437" }, { "category": "external", "summary": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp", "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp" } ], "release_date": "2022-12-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "hazelcast: Hazelcast connection caching" }, { "cve": "CVE-2022-38398", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155292" } ], "notes": [ { "category": "description", "text": "Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Server-Side Request Forgery", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38398" }, { "category": "external", "summary": "RHBZ#2155292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155292" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38398", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38398" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38398", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38398" }, { "category": "external", "summary": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903462", "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903462" }, { "category": "external", "summary": "https://issues.apache.org/jira/browse/BATIK-1331", "url": "https://issues.apache.org/jira/browse/BATIK-1331" }, { "category": "external", "summary": "https://lists.apache.org/thread/712c9xwtmyghyokzrm2ml6sps4xlmbsx", "url": "https://lists.apache.org/thread/712c9xwtmyghyokzrm2ml6sps4xlmbsx" } ], "release_date": "2022-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Server-Side Request Forgery" }, { "cve": "CVE-2022-38648", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155295" } ], "notes": [ { "category": "description", "text": "Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Server-Side Request Forgery", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38648" }, { "category": "external", "summary": "RHBZ#2155295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155295" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38648", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38648" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38648", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38648" }, { "category": "external", "summary": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903625", "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903625" }, { "category": "external", "summary": "https://issues.apache.org/jira/browse/BATIK-1333", "url": "https://issues.apache.org/jira/browse/BATIK-1333" }, { "category": "external", "summary": "https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b", "url": "https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b" } ], "release_date": "2022-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Server-Side Request Forgery" }, { "cve": "CVE-2022-40146", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155291" } ], "notes": [ { "category": "description", "text": "Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Server-Side Request Forgery (SSRF) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40146" }, { "category": "external", "summary": "RHBZ#2155291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40146", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40146" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40146", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40146" }, { "category": "external", "summary": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903910", "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1903910" }, { "category": "external", "summary": "https://issues.apache.org/jira/browse/BATIK-1335", "url": "https://issues.apache.org/jira/browse/BATIK-1335" }, { "category": "external", "summary": "https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx", "url": "https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx" } ], "release_date": "2022-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Server-Side Request Forgery (SSRF) vulnerability" }, { "cve": "CVE-2022-41704", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2023-03-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182182" } ], "notes": [ { "category": "description", "text": "A flaw was found in Batik.\u00a0This issue may allow a malicious user to run untrusted Java code from an SVG.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Apache XML Graphics Batik vulnerable to code execution via SVG", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41704" }, { "category": "external", "summary": "RHBZ#2182182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182182" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41704", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41704" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41704", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41704" } ], "release_date": "2022-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Apache XML Graphics Batik vulnerable to code execution via SVG" }, { "cve": "CVE-2022-41854", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2151988" } ], "notes": [ { "category": "description", "text": "Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "dev-java/snakeyaml: DoS via stack overflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41854" }, { "category": "external", "summary": "RHBZ#2151988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2151988" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41854", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41854" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/543/stackoverflow-oss-fuzz-50355", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/543/stackoverflow-oss-fuzz-50355" }, { "category": "external", "summary": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355" } ], "release_date": "2022-11-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "dev-java/snakeyaml: DoS via stack overflow" }, { "cve": "CVE-2022-41881", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "discovery_date": "2022-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2153379" } ], "notes": [ { "category": "description", "text": "A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41881" }, { "category": "external", "summary": "RHBZ#2153379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881" } ], "release_date": "2022-12-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS" }, { "cve": "CVE-2022-41940", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "discovery_date": "2022-11-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2144970" } ], "notes": [ { "category": "description", "text": "A flaw was found in engine.io. The Socket.IO Engine.IO is vulnerable to a denial of service caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote, authenticated attacker can cause the Node.js process to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "engine.io: Specially crafted HTTP request can trigger an uncaught exception", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41940" }, { "category": "external", "summary": "RHBZ#2144970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41940", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41940" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41940", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41940" } ], "release_date": "2022-11-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "engine.io: Specially crafted HTTP request can trigger an uncaught exception" }, { "cve": "CVE-2022-41946", "cwe": { "id": "CWE-377", "name": "Insecure Temporary File" }, "discovery_date": "2022-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2153399" } ], "notes": [ { "category": "description", "text": "A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setText(int, InputStream) and PreparedStatemet.setBytea(int, InputStream). This could allow a user to create an unexpected file available to all users, which could end in unexpected behavior.", "title": "Vulnerability description" }, { "category": "summary", "text": "postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite ships a PostgreSQL JDBC Driver for Hibernate ORM framework, which is embeds into Candlepin. Although Candlepin itself doesn\u0027t make direct use of the PreparedStatement methods from the PostgreSQL JDBC Driver, Hibernate ORM does utilize these methods, potentially making framework affected. Satellite server operating in an environment with untrusted users while the driver is running are vulnerable to the flaw, however, deployments without untrusted users are considered safe. A future Satellite update should address this issue.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41946" }, { "category": "external", "summary": "RHBZ#2153399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153399" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41946", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41946" } ], "release_date": "2022-11-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions" }, { "cve": "CVE-2022-41966", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170431" } ], "notes": [ { "category": "description", "text": "A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow.", "title": "Vulnerability description" }, { "category": "summary", "text": "xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse 7 ships an affected version of XStream. No endpoint in any flavor of Fuse is accepting by default an unverified input stream passed directly to XStream unmarshaller. Documentation always recommend all the endpoints (TCP/UDP/HTTP(S)/other listeners) to have at least one layer of authentication/authorization and Fuse in general itself in particular has a lot of mechanisms to protect the endpoints.\n\nRed Hat Single Sign-On contains XStream as a transitive dependency from Infinispan and the same is not affected as NO_REFERENCE is in use.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41966" }, { "category": "external", "summary": "RHBZ#2170431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170431" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41966", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41966" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41966", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41966" }, { "category": "external", "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv", "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv" } ], "release_date": "2022-12-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow" }, { "cve": "CVE-2022-42890", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2023-03-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182183" } ], "notes": [ { "category": "description", "text": "A flaw was found in Batik of Apache XML Graphics. This issue may allow a malicious user to run Java code from untrusted SVG via JavaScript.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Untrusted code execution in Apache XML Graphics Batik", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42890" }, { "category": "external", "summary": "RHBZ#2182183", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182183" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42890", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42890" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42890", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42890" } ], "release_date": "2022-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Untrusted code execution in Apache XML Graphics Batik" }, { "cve": "CVE-2022-42920", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2142707" } ], "notes": [ { "category": "description", "text": "An out-of-bounds (OOB) write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected.", "title": "Vulnerability description" }, { "category": "summary", "text": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing", "title": "Vulnerability summary" }, { "category": "other", "text": "Fuse 7 ships the code in question but does not utilize it in the product, so it is affected at a reduced impact of Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42920" }, { "category": "external", "summary": "RHBZ#2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42920", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920" }, { "category": "external", "summary": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4", "url": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing" }, { "cve": "CVE-2022-45143", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "discovery_date": "2023-01-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158695" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Tomcat package. This flaw allowed users to input an invalid JSON structure, causing unwanted behavior as it did not escape the type, message, or description values.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: JsonErrorReportValve injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Although it may be rated as CVSS 7.5, it\u0027s still considered a low impact flaw as according to the advisory report from Apache, user controlled data may occur in specific cases only and may alter some specific fields only.\n\nRed Hat Satellite does not include the affected Apache Tomcat, however, Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45143" }, { "category": "external", "summary": "RHBZ#2158695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45143", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45143" }, { "category": "external", "summary": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj", "url": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj" } ], "release_date": "2023-01-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: JsonErrorReportValve injection" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" }, { "cve": "CVE-2023-1108", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2023-02-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2174246" } ], "notes": [ { "category": "description", "text": "A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: Infinite loop in SslConduit during close", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-1108" }, { "category": "external", "summary": "RHBZ#2174246", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2174246" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-1108", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1108" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-1108", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1108" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-m4mm-pg93-fv78", "url": "https://github.com/advisories/GHSA-m4mm-pg93-fv78" } ], "release_date": "2023-03-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Undertow: Infinite loop in SslConduit during close" }, { "cve": "CVE-2023-1370", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "discovery_date": "2023-04-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2188542" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json-smart package. This security flaw occurs when reaching a \u2018[\u2018 or \u2018{\u2018 character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.", "title": "Vulnerability description" }, { "category": "summary", "text": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-1370" }, { "category": "external", "summary": "RHBZ#2188542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-1370", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-493p-pfq6-5258", "url": "https://github.com/advisories/GHSA-493p-pfq6-5258" }, { "category": "external", "summary": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/", "url": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/" } ], "release_date": "2023-03-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)" }, { "cve": "CVE-2023-20860", "cwe": { "id": "CWE-155", "name": "Improper Neutralization of Wildcards or Matching Symbols" }, "discovery_date": "2023-03-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2180528" } ], "notes": [ { "category": "description", "text": "A flaw was found in Spring Framework. In this vulnerability, a security bypass is possible due to the behavior of the wildcard pattern.", "title": "Vulnerability description" }, { "category": "summary", "text": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-20860" }, { "category": "external", "summary": "RHBZ#2180528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180528" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-20860", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20860" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-20860", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20860" }, { "category": "external", "summary": "https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861", "url": "https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861" } ], "release_date": "2023-03-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern" }, { "cve": "CVE-2023-20861", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-03-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2180530" } ], "notes": [ { "category": "description", "text": "A flaw found was found in Spring Framework. This flaw allows a malicious user to use a specially crafted SpEL expression that causes a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "springframework: Spring Expression DoS Vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-20861" }, { "category": "external", "summary": "RHBZ#2180530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180530" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-20861", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20861" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, { "category": "external", "summary": "https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861", "url": "https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861" } ], "release_date": "2023-03-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "springframework: Spring Expression DoS Vulnerability" }, { "cve": "CVE-2023-20883", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-05-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2209342" } ], "notes": [ { "category": "description", "text": "A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot\u0027s welcome page support, either static or templated, resulting in the application being deployed behind a proxy that caches 404 responses. This issue may cause a denial of service (DoS) attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "spring-boot: Spring Boot Welcome Page DoS Vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-20883" }, { "category": "external", "summary": "RHBZ#2209342", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209342" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-20883", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" } ], "release_date": "2023-05-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "spring-boot: Spring Boot Welcome Page DoS Vulnerability" }, { "cve": "CVE-2023-22602", "cwe": { "id": "CWE-436", "name": "Interpretation Conflict" }, "discovery_date": "2023-03-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182198" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Shiro. This issue may allow a malicious user to send a specially crafted HTTP request that could cause an authentication bypass.", "title": "Vulnerability description" }, { "category": "summary", "text": "shiro: Authentication bypass through a specially crafted HTTP request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-22602" }, { "category": "external", "summary": "RHBZ#2182198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182198" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-22602", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22602" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-22602", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22602" } ], "release_date": "2023-01-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "shiro: Authentication bypass through a specially crafted HTTP request" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.12" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-29T20:07:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Fuse 7.12" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3954" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Fuse 7.12" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" } ] }
rhsa-2023_7669
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat build of Cryostat 2.4.0 on RHEL 8 container images are now available", "title": "Topic" }, { "category": "general", "text": "New Red Hat build of Cryostat 2.4.0 on RHEL 8 container images have been released, adding a variety of features and bug fixes.\n\nUsers of the Red Hat build of Cryostat 2.3.1 on RHEL 8 container images are advised to upgrade to these updated images, which contain backported patches to fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.\n\nSecurity Fix(es):\n\n* vertx-web: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route (CVE-2023-24815)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* netty: SniHandler 16MB allocation leads to OOM (CVE-2023-34462)\n\nYou can find images updated by this advisory in Red Hat Container Catalog (see References).", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7669", "url": "https://access.redhat.com/errata/RHSA-2023:7669" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2209400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209400" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "JAVAMON-236", "url": "https://issues.redhat.com/browse/JAVAMON-236" }, { "category": "external", "summary": "JAVAMON-241", "url": "https://issues.redhat.com/browse/JAVAMON-241" }, { "category": "external", "summary": "JAVAMON-243", "url": "https://issues.redhat.com/browse/JAVAMON-243" }, { "category": "external", "summary": "JAVAMON-313", "url": "https://issues.redhat.com/browse/JAVAMON-313" }, { "category": "external", "summary": "JAVAMON-319", "url": "https://issues.redhat.com/browse/JAVAMON-319" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7669.json" } ], "title": "Red Hat Security Advisory: Red Hat build of Cryostat 2.4.0: new RHEL 8 container images", "tracking": { "current_release_date": "2024-11-06T04:29:45+00:00", "generator": { "date": "2024-11-06T04:29:45+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7669", "initial_release_date": "2023-12-06T22:07:18+00:00", "revision_history": [ { "date": "2023-12-06T22:07:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-12-06T22:07:18+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:29:45+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Cryostat 2 on RHEL 8", "product": { "name": "Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2", "product_identification_helper": { "cpe": "cpe:/a:redhat:cryostat:2::el8" } } } ], "category": "product_family", "name": "Cryostat" }, { "branches": [ { "category": "product_version", "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "product": { "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "product_id": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "product_identification_helper": { "purl": "pkg:oci/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-grafana-dashboard-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "product": { "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "product_id": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "product_identification_helper": { "purl": "pkg:oci/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-reports-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "product": { "name": "cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "product_id": "cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "product_identification_helper": { "purl": "pkg:oci/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "product": { "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "product_id": "cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "product_identification_helper": { "purl": "pkg:oci/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-operator-bundle\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "product": { "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "product_id": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "product_identification_helper": { "purl": "pkg:oci/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8-operator\u0026tag=2.4.0-3" } } }, { "category": "product_version", "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64", "product": { "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64", "product_id": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64", "product_identification_helper": { "purl": "pkg:oci/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b?arch=arm64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/jfr-datasource-rhel8\u0026tag=2.4.0-2" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "product": { "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "product_id": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "product_identification_helper": { "purl": "pkg:oci/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-grafana-dashboard-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "product": { "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "product_id": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "product_identification_helper": { "purl": "pkg:oci/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-reports-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "product": { "name": "cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "product_id": "cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "product_identification_helper": { "purl": "pkg:oci/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "product": { "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "product_id": "cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "product_identification_helper": { "purl": "pkg:oci/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-operator-bundle\u0026tag=2.4.0-2" } } }, { "category": "product_version", "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "product": { "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "product_id": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "product_identification_helper": { "purl": "pkg:oci/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8-operator\u0026tag=2.4.0-3" } } }, { "category": "product_version", "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "product": { "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "product_id": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "product_identification_helper": { "purl": "pkg:oci/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/jfr-datasource-rhel8\u0026tag=2.4.0-2" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64" }, "product_reference": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64" }, "product_reference": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64" }, "product_reference": "cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64" }, "product_reference": "cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64" }, "product_reference": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64" }, "product_reference": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64" }, "product_reference": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64" }, "product_reference": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64" }, "product_reference": "cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64" }, "product_reference": "cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64" }, "product_reference": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "relates_to_product_reference": "8Base-Cryostat-2" }, { "category": "default_component_of", "full_product_name": { "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64 as a component of Cryostat 2 on RHEL 8", "product_id": "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" }, "product_reference": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64", "relates_to_product_reference": "8Base-Cryostat-2" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-24815", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2023-05-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2209400" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vert.X Web. When running the application that serves files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (*), an attacker can exfiltrate any class path resource.", "title": "Vulnerability description" }, { "category": "summary", "text": "vertx-web: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24815" }, { "category": "external", "summary": "RHBZ#2209400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209400" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24815", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24815" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24815", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24815" }, { "category": "external", "summary": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38", "url": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38" } ], "release_date": "2023-02-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T22:07:18+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7669" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vertx-web: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T22:07:18+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7669" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T22:07:18+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7669" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:5138e1feda1fd225914b9705f3cd88525b783ada5f672c20392abf003bd334c7_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:7cbc39b1a3b490b3118980e9fbff1aeba74705e435eaa3d6ba75f39a86a924d4_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:90e788b71753d6a569f5907c8cb1e8f2633a11ed4f9f3df1bcbba6ab9c9110e7_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:ca23f4944519260549274d79c3cfda72bee9dbad380218cacea9fbc055ed3420_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:1b8dfb006d0c449350b5683c9ac3576ab0256a9c7c1a068a8486bfb717d0b7ed_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:7130279b46d9546449494e613dea6c53390c6ee3e2e894d4f89583182e58bc98_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:1c9fe1c25eb9f3e7501c8f065f2248e5e46bba17849b2b760198490dc7f94428_amd64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:3f179ccc29afd98d882dbbb90954cab6b34f23db8110663264d7b3de94b32d36_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:0e11667c5eeac5bed4f636f056f248d101d45b4b840efc55e636410f4865bcd2_arm64", "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:ab2ecd8c68bfe794bb26efab1fdeadb2015efc4a827d4c45cb1b16133288ce4f_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:492a3d8ed08d3b385665c93071fa6c3a1e5e4389b6d0780ef0014ffebfa61415_amd64", "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:70ee85830ebc5d89ba87d301d3731cbafa89247a3b2c23667aaa123e710cb90b_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2023_7484
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.6 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.5, and includes bug fixes and enhancements.\n\nSecurity Fix(es):\n\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n* keycloak: impersonation and lockout possible through incorrect handling of email trust (CVE-2023-0105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7484", "url": "https://access.redhat.com/errata/RHSA-2023:7484" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7484.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9", "tracking": { "current_release_date": "2024-11-06T04:25:10+00:00", "generator": { "date": "2024-11-06T04:25:10+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7484", "initial_release_date": "2023-11-24T16:56:41+00:00", "revision_history": [ { "date": "2023-11-24T16:56:41+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-24T16:56:41+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:25:10+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el9sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el9sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.11-2.redhat_00001.1.el9sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Willem Noort" ], "organization": "Inverid", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0105", "cwe": { "id": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158910" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: impersonation and lockout possible through incorrect handling of email trust", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0105" }, { "category": "external", "summary": "RHBZ#2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj", "url": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj" } ], "release_date": "2023-01-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:41+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: impersonation and lockout possible through incorrect handling of email trust" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:41+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-10-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242803" } ], "notes": [ { "category": "description", "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "title": "Vulnerability summary" }, { "category": "other", "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44487" }, { "category": "external", "summary": "RHBZ#2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "external", "summary": "RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "category": "external", "summary": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2102", "url": "https://pkg.go.dev/vuln/GO-2023-2102" }, { "category": "external", "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "category": "external", "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2023-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:41+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7484" }, { "category": "workaround", "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2023-10-10T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)" } ] }
rhsa-2023_5486
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)\n\n* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor (CVE-2023-4061)\n\n* tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5486", "url": "https://access.redhat.com/errata/RHSA-2023:5486" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "JBEAP-24667", "url": "https://issues.redhat.com/browse/JBEAP-24667" }, { "category": "external", "summary": "JBEAP-24799", "url": "https://issues.redhat.com/browse/JBEAP-24799" }, { "category": "external", "summary": "JBEAP-24966", "url": "https://issues.redhat.com/browse/JBEAP-24966" }, { "category": "external", "summary": "JBEAP-24985", "url": "https://issues.redhat.com/browse/JBEAP-24985" }, { "category": "external", "summary": "JBEAP-25032", "url": "https://issues.redhat.com/browse/JBEAP-25032" }, { "category": "external", "summary": "JBEAP-25033", "url": "https://issues.redhat.com/browse/JBEAP-25033" }, { "category": "external", "summary": "JBEAP-25078", "url": "https://issues.redhat.com/browse/JBEAP-25078" }, { "category": "external", "summary": "JBEAP-25122", "url": "https://issues.redhat.com/browse/JBEAP-25122" }, { "category": "external", "summary": "JBEAP-25135", "url": "https://issues.redhat.com/browse/JBEAP-25135" }, { "category": "external", "summary": "JBEAP-25186", "url": "https://issues.redhat.com/browse/JBEAP-25186" }, { "category": "external", "summary": "JBEAP-25200", "url": "https://issues.redhat.com/browse/JBEAP-25200" }, { "category": "external", "summary": "JBEAP-25225", "url": "https://issues.redhat.com/browse/JBEAP-25225" }, { "category": "external", "summary": "JBEAP-25261", "url": "https://issues.redhat.com/browse/JBEAP-25261" }, { "category": "external", "summary": "JBEAP-25285", "url": "https://issues.redhat.com/browse/JBEAP-25285" }, { "category": "external", "summary": "JBEAP-25312", "url": "https://issues.redhat.com/browse/JBEAP-25312" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5486.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9", "tracking": { "current_release_date": "2024-11-06T03:48:06+00:00", "generator": { "date": "2024-11-06T03:48:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5486", "initial_release_date": "2023-10-06T03:41:07+00:00", "revision_history": [ { "date": "2023-10-06T03:41:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-10-06T03:41:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:48:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 9", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el9eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.20-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-31.Final_redhat_00030.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-31.Final_redhat_00030.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-buffer@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-dns@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-haproxy@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http2@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-memcache@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-mqtt@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-redis@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-smtp@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-socks@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-stomp@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-xml@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-common@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler-proxy@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns-classes-macos@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-epoll@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-kqueue@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-unix-common@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-rxtx@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-sctp@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-udt@4.1.94-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling-river@2.0.13-2.SP1_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.15-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-cli@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-commons@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-core-client@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-dto@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hornetq-protocol@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hqclient-protocol@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jdbc-store@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-client@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-server@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-journal@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-ra@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-selector@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-server@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-service-extensions@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_id": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-tools@2.16.0-15.redhat_00049.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-mail@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pg@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pkix@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-prov@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_id": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-util@1.76.0-4.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk17@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.13-8.GA_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-atom-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-cdi@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-client@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-crypto@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson2-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxb-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxrs@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jettison-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jose-jwt@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jsapi@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-binding-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-p-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-multipart-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-rxjava2@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-spring@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-validator-provider-11@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-yaml-provider@3.15.8-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-core@5.3.31-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-envers@5.3.31-1.Final_redhat_00001.1.el9eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el9eap?arch=x86_64" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll-debuginfo@4.1.94-1.Final_redhat_00001.1.el9eap?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch" }, "product_reference": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-25883", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-06-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216475" } ], "notes": [ { "category": "description", "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the \u0027new Range\u0027 function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-semver: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25883" }, { "category": "external", "summary": "RHBZ#2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795", "url": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795" } ], "release_date": "2023-06-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-semver: Regular expression denial of service" }, { "cve": "CVE-2023-3171", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "discovery_date": "2023-04-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2213639" } ], "notes": [ { "category": "description", "text": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "eap-7: heap exhaustion via deserialization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3171" }, { "category": "external", "summary": "RHBZ#2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3171", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3171" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "eap-7: heap exhaustion via deserialization" }, { "cve": "CVE-2023-4061", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-08-02T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2228608" } ], "notes": [ { "category": "description", "text": "A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability requires a malicious user to previously have access to the system, especially access to the HAL interface via browser and logged with a management user who have access to the resolve-expression method, hence the moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-4061" }, { "category": "external", "summary": "RHBZ#2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-4061", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4061" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" }, { "category": "workaround", "details": "Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor" }, { "acknowledgments": [ { "names": [ "Kokorin Vsevolod" ] } ], "cve": "CVE-2023-26136", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2023-07-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2219310" } ], "notes": [ { "category": "description", "text": "A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.", "title": "Vulnerability description" }, { "category": "summary", "text": "tough-cookie: prototype pollution in cookie memstore", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26136" }, { "category": "external", "summary": "RHBZ#2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26136", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26136" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e", "url": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/issues/282", "url": "https://github.com/salesforce/tough-cookie/issues/282" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3", "url": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873", "url": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873" } ], "release_date": "2023-07-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tough-cookie: prototype pollution in cookie memstore" }, { "cve": "CVE-2023-26464", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182864" } ], "notes": [ { "category": "description", "text": "A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.", "title": "Vulnerability description" }, { "category": "summary", "text": "log4j1-socketappender: DoS via hashmap logging", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux 8 and 9 security impacts have been reduced to Low as they do not enable the vulnerable JDK by default.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26464" }, { "category": "external", "summary": "RHBZ#2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26464", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464" }, { "category": "external", "summary": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464", "url": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464" } ], "release_date": "2023-03-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "log4j1-socketappender: DoS via hashmap logging" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T03:41:07+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5486" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap.src", "9Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el9eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el9eap.x86_64", "9Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el9eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2023_7678
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat AMQ Streams 2.6.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. \n\nThis release of Red Hat AMQ Streams 2.6.0 serves as a replacement for Red Hat AMQ Streams 2.5.1, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n\n* JSON-java: parser confusion leads to OOM (CVE-2023-5072)\n\n* spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry (CVE-2023-20873)\n\n* zookeeper: Authorization Bypass in Apache ZooKeeper (CVE-2023-44981)\n\n* apache-ivy: XML External Entity vulnerability (CVE-2022-46751)\n\n* guava: insecure temporary directory creation (CVE-2023-2976)\n\n* jose4j: Insecure iteration count setting (CVE-2023-31582)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)\n\n* tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)\n\n* gradle: Possible local text file exfiltration by XML External entity injection (CVE-2023-42445)\n\n* gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations (CVE-2023-44387)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7678", "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.6.0", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.6.0" }, { "category": "external", "summary": "2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2231491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2231491" }, { "category": "external", "summary": "2233112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233112" }, { "category": "external", "summary": "2235370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235370" }, { "category": "external", "summary": "2239634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239634" }, { "category": "external", "summary": "2242485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242485" }, { "category": "external", "summary": "2242538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242538" }, { "category": "external", "summary": "2243436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243436" }, { "category": "external", "summary": "2246370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246370" }, { "category": "external", "summary": "2246417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246417" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7678.json" } ], "title": "Red Hat Security Advisory: Red Hat AMQ Streams 2.6.0 release and security update", "tracking": { "current_release_date": "2024-11-06T04:29:35+00:00", "generator": { "date": "2024-11-06T04:29:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7678", "initial_release_date": "2023-12-06T23:30:39+00:00", "revision_history": [ { "date": "2023-12-06T23:30:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-12-06T23:30:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:29:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Streams 2.6.0", "product": { "name": "Red Hat AMQ Streams 2.6.0", "product_id": "Red Hat AMQ Streams 2.6.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:2" } } } ], "category": "product_family", "name": "Red Hat JBoss AMQ" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-46751", "cwe": { "id": "CWE-91", "name": "XML Injection (aka Blind XPath Injection)" }, "discovery_date": "2023-08-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2233112" } ], "notes": [ { "category": "description", "text": "Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.\n\nWhen Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.\n\nThis can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.\n\nStarting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.\n\nUsers of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about \"JAXP Properties for External Access restrictions\" inside Oracle\u0027s \"Java API for XML Processing (JAXP) Security Guide\".\n\n", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-ivy: XML External Entity vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46751" }, { "category": "external", "summary": "RHBZ#2233112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233112" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46751" }, { "category": "external", "summary": "https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8", "url": "https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8" } ], "release_date": "2023-08-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-ivy: XML External Entity vulnerability" }, { "cve": "CVE-2023-2976", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "discovery_date": "2023-06-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215229" } ], "notes": [ { "category": "description", "text": "A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.", "title": "Vulnerability description" }, { "category": "summary", "text": "guava: insecure temporary directory creation", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Single Sign-On 7 ships the affected component as a layered product of Red Hat JBoss Enterprise Application 7, and as such is affected by this flaw. However, Single Sign-On 7 does not use the affected code and is not vulnerable to exploit.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-2976" }, { "category": "external", "summary": "RHBZ#2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-2976", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" } ], "release_date": "2023-06-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "guava: insecure temporary directory creation" }, { "cve": "CVE-2023-5072", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-10-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2246417" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.json package. A bug in the parser exists, and an input string may lead to undefined usage of memory, leading to an out-of-memory error, causing a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "JSON-java: parser confusion leads to OOM", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability may cause denial of service with a small string input, causing the server to be unresponsive easily, hence the Important impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-5072" }, { "category": "external", "summary": "RHBZ#2246417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246417" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-5072", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5072" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-5072", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5072" }, { "category": "external", "summary": "https://github.com/stleary/JSON-java/issues/758", "url": "https://github.com/stleary/JSON-java/issues/758" }, { "category": "external", "summary": "https://github.com/stleary/JSON-java/issues/771", "url": "https://github.com/stleary/JSON-java/issues/771" } ], "release_date": "2023-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "No current mitigation is available for this flaw.", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JSON-java: parser confusion leads to OOM" }, { "cve": "CVE-2023-20873", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2023-04-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2231491" } ], "notes": [ { "category": "description", "text": "A flaw was found in Spring Boot. This targets specifically \u0027spring-boot-actuator-autoconfigure\u0027 package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass.\r\n\r\nSpecifically, an application is vulnerable when all of the following are true:\r\n\r\n * You have code that can handle requests that match /cloudfoundryapplication/**. Typically, this will be if there is a catch-all request mapping which matches /**.\r\n * The application is deployed to Cloud Foundry.\r\n\r\nAn application is not vulnerable if any of the following is true:\r\n\r\n * The application is not deployed to Cloud Foundry\r\n * You have disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false.\r\n * Your application does not have handler mappings that can handle requests to /cloudfoundryapplication/**.", "title": "Vulnerability description" }, { "category": "summary", "text": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry", "title": "Vulnerability summary" }, { "category": "other", "text": "The following Red Hat products do not ship the affected software component and so are not affected:\n\n * Red Hat Enterprise Linux 8, 9\n * Enterprise Application Platform 6, 7, 8, XP\n * Data Grid 7, 8\n * Migration Toolkit for Runtimes\n * Red Hat Build of OptaPlanner\n * Red Hat Integration Camel-K\n * Red Hat AMQ Broker 7\n * Red Hat AMQ Clients 2\n * Red Hat AMQ Streams 2\n * Red Hat Fuse 6\n * Red Hat Fuse 7\n * Red Hat VertX 4\n\nThe following Red Hat products ship the affected software but do not enable or do not ship the vulnerable classes, and so are affected but at Low security impact.\n\n * Red Hat Decision Manager 7\n * Red Hat Process Automation Manager 7\n * Red Hat Single Sign-On 7", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-20873" }, { "category": "external", "summary": "RHBZ#2231491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2231491" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-20873", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20873" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-20873", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20873" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-g5h3-w546-pj7f", "url": "https://github.com/advisories/GHSA-g5h3-w546-pj7f" }, { "category": "external", "summary": "https://spring.io/security/cve-2023-20873/", "url": "https://spring.io/security/cve-2023-20873/" } ], "release_date": "2023-05-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "Disable Cloud Foundry actuator endpoints by setting \u0027management.cloudfoundry.enabled\u0027 to false.", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry" }, { "cve": "CVE-2023-31582", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2023-10-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2246370" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure.", "title": "Vulnerability description" }, { "category": "summary", "text": "jose4j: Insecure iteration count setting", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw would require manually setting of the number of iterations under 1000 for Json Web Encryption, therefore, a malicious user would need previous access to modify it. Also, a user would still be able to set the variable incorrectly and make the environment less secure for JWE. This is currently rated as a moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-31582" }, { "category": "external", "summary": "RHBZ#2246370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-31582", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31582" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-31582", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31582" }, { "category": "external", "summary": "https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then", "url": "https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then" }, { "category": "external", "summary": "https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md", "url": "https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md" } ], "release_date": "2023-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "No mitigation is currently available for this flaw.", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jose4j: Insecure iteration count setting" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-40167", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2023-09-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2239634" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jetty that permits a plus sign (+) preceding the content-length value in a HTTP/1 header field, which is non-standard and more permissive than RFC. This issue could allow an attacker to request smuggling in conjunction with a server that does not close connections after 400 responses.", "title": "Vulnerability description" }, { "category": "summary", "text": "jetty: Improper validation of HTTP/1 content-length", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-40167" }, { "category": "external", "summary": "RHBZ#2239634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239634" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40167", "url": "https://www.cve.org/CVERecord?id=CVE-2023-40167" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6" }, { "category": "external", "summary": "https://www.rfc-editor.org/rfc/rfc9110#section-8.6", "url": "https://www.rfc-editor.org/rfc/rfc9110#section-8.6" } ], "release_date": "2023-09-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jetty: Improper validation of HTTP/1 content-length" }, { "cve": "CVE-2023-41080", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2023-08-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2235370" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Open Redirect vulnerability in FORM authentication", "title": "Vulnerability summary" }, { "category": "other", "text": "The pki-servlet-engine package has been obsoleted by the Tomcat package. Therefore, this issue will be fixed in the Tomcat package rather than the pki-serlvet-engine package. Please follow the RHEL Tomcat trackers instead for the updates.\n\nRed Hat Satellite is not directly impacted by this issue, since it does not embed the dependency on their offer deliveries. However, end users of Red Hat Satellite are using Tomcat via RHEL channels, which provides Tomcat dependency needed by candlepin to function in Satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-41080" }, { "category": "external", "summary": "RHBZ#2235370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-41080", "url": "https://www.cve.org/CVERecord?id=CVE-2023-41080" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080" }, { "category": "external", "summary": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f", "url": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f" } ], "release_date": "2023-08-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Open Redirect vulnerability in FORM authentication" }, { "cve": "CVE-2023-42445", "cwe": { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" }, "discovery_date": "2023-10-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242538" } ], "notes": [ { "category": "description", "text": "A flaw was found in Gradle. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), parsing XML can lead to the exfiltration of local text files to a remote server. In most cases, Gradle parses XML files it generated, or that were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle.", "title": "Vulnerability description" }, { "category": "summary", "text": "gradle: Possible local text file exfiltration by XML External entity injection", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-42445" }, { "category": "external", "summary": "RHBZ#2242538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242538" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-42445", "url": "https://www.cve.org/CVERecord?id=CVE-2023-42445" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-42445", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42445" }, { "category": "external", "summary": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8", "url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8" } ], "release_date": "2023-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "gradle: Possible local text file exfiltration by XML External entity injection" }, { "cve": "CVE-2023-44387", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2023-10-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242485" } ], "notes": [ { "category": "description", "text": "A flaw was found in Gradle. When copying files or creating archives, Gradle does not preserve symbolic links, instead resolving them to their underlying target file, but permissions of the new file use those of the link instead of those from the target file. This issue can lead to files with broader permissions than intended, as symbolic links are usually world-readable and writeable.", "title": "Vulnerability description" }, { "category": "summary", "text": "gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44387" }, { "category": "external", "summary": "RHBZ#2242485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242485" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44387", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44387" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44387", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44387" }, { "category": "external", "summary": "https://github.com/gradle/gradle/security/advisories/GHSA-43r3-pqhv-f7h9", "url": "https://github.com/gradle/gradle/security/advisories/GHSA-43r3-pqhv-f7h9" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations" }, { "cve": "CVE-2023-44981", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "discovery_date": "2023-10-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2243436" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache ZooKeeper. Authorization bypass through user-controlled key is available iff SASL Quorum Peer authentication is enabled in ZooKeeper via quorum.auth.enableSasl=true configuration. A malicious user could bypass the authentication controller by using a non-existing instance part in SASL authentication ID (which is optional), therefore, the server would skip this check and as a result, join the cluster and propagate information with complete read and write access.", "title": "Vulnerability description" }, { "category": "summary", "text": "zookeeper: Authorization Bypass in Apache ZooKeeper", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat AMQ 7 Broker and Red Hat AMQ Streams 2 use Zookeeper but do not use or enable the vulnerable functionality, Peer Authentication. They are affected at Moderate Impact by this flaw.\n\nRed Hat Fuse 7 uses Zookeeper but does not use any of its server capabilities and as such is not vulnerable, and so is affected at Low Impact by this flaw.\n\nRed Hat Process Automation Manager 7 and Red Hat Decision Manager 7 do not ship zookeeper, and so are not affected by this flaw.\n\nRed Hat Fuse 6 and AMQ 6 use Zookeeper but are not vulnerable to this flaw, and have been assessed as Important Impact and are as such out of security support scope for this flaw.\n\nRed Hat Business Process Manager Suite 6, Red Hat Business Rules Management Suite 6, Red Hat JBoss Data Virtualization 6, Red Hat OpenShift Application Runtime Vert-x, and Red Hat Fuse Service Works 6 are out of security support scope for this flaw.\n\nAs no Red Hat products are affected at Critical Impact by this flaw, its overall impact has been reduced to Important.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.6.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44981" }, { "category": "external", "summary": "RHBZ#2243436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243436" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44981", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44981" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44981", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44981" }, { "category": "external", "summary": "https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b", "url": "https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b" } ], "release_date": "2023-10-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-12-06T23:30:39+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "workaround", "details": "According to Apache\u0027s document: Ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.", "product_ids": [ "Red Hat AMQ Streams 2.6.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.6.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "zookeeper: Authorization Bypass in Apache ZooKeeper" } ] }
rhsa-2023_5488
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)\n\n* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor (CVE-2023-4061)\n\n* tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5488", "url": "https://access.redhat.com/errata/RHSA-2023:5488" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "JBEAP-24667", "url": "https://issues.redhat.com/browse/JBEAP-24667" }, { "category": "external", "summary": "JBEAP-24966", "url": "https://issues.redhat.com/browse/JBEAP-24966" }, { "category": "external", "summary": "JBEAP-24985", "url": "https://issues.redhat.com/browse/JBEAP-24985" }, { "category": "external", "summary": "JBEAP-25032", "url": "https://issues.redhat.com/browse/JBEAP-25032" }, { "category": "external", "summary": "JBEAP-25033", "url": "https://issues.redhat.com/browse/JBEAP-25033" }, { "category": "external", "summary": "JBEAP-25078", "url": "https://issues.redhat.com/browse/JBEAP-25078" }, { "category": "external", "summary": "JBEAP-25122", "url": "https://issues.redhat.com/browse/JBEAP-25122" }, { "category": "external", "summary": "JBEAP-25135", "url": "https://issues.redhat.com/browse/JBEAP-25135" }, { "category": "external", "summary": "JBEAP-25186", "url": "https://issues.redhat.com/browse/JBEAP-25186" }, { "category": "external", "summary": "JBEAP-25200", "url": "https://issues.redhat.com/browse/JBEAP-25200" }, { "category": "external", "summary": "JBEAP-25225", "url": "https://issues.redhat.com/browse/JBEAP-25225" }, { "category": "external", "summary": "JBEAP-25261", "url": "https://issues.redhat.com/browse/JBEAP-25261" }, { "category": "external", "summary": "JBEAP-25285", "url": "https://issues.redhat.com/browse/JBEAP-25285" }, { "category": "external", "summary": "JBEAP-25312", "url": "https://issues.redhat.com/browse/JBEAP-25312" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5488.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update", "tracking": { "current_release_date": "2024-11-06T03:47:46+00:00", "generator": { "date": "2024-11-06T03:47:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5488", "initial_release_date": "2023-10-05T20:18:28+00:00", "revision_history": [ { "date": "2023-10-05T20:18:28+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-10-05T20:18:28+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:47:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "EAP 7.4.13", "product": { "name": "EAP 7.4.13", "product_id": "EAP 7.4.13", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-25883", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-06-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216475" } ], "notes": [ { "category": "description", "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the \u0027new Range\u0027 function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-semver: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25883" }, { "category": "external", "summary": "RHBZ#2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795", "url": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795" } ], "release_date": "2023-06-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-semver: Regular expression denial of service" }, { "cve": "CVE-2023-3171", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "discovery_date": "2023-04-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2213639" } ], "notes": [ { "category": "description", "text": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "eap-7: heap exhaustion via deserialization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3171" }, { "category": "external", "summary": "RHBZ#2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3171", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3171" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "eap-7: heap exhaustion via deserialization" }, { "cve": "CVE-2023-4061", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-08-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2228608" } ], "notes": [ { "category": "description", "text": "A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability requires a malicious user to previously have access to the system, especially access to the HAL interface via browser and logged with a management user who have access to the resolve-expression method, hence the moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-4061" }, { "category": "external", "summary": "RHBZ#2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-4061", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4061" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" }, { "category": "workaround", "details": "Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.", "product_ids": [ "EAP 7.4.13" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor" }, { "acknowledgments": [ { "names": [ "Kokorin Vsevolod" ] } ], "cve": "CVE-2023-26136", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2023-07-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2219310" } ], "notes": [ { "category": "description", "text": "A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.", "title": "Vulnerability description" }, { "category": "summary", "text": "tough-cookie: prototype pollution in cookie memstore", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26136" }, { "category": "external", "summary": "RHBZ#2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26136", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26136" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e", "url": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/issues/282", "url": "https://github.com/salesforce/tough-cookie/issues/282" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3", "url": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873", "url": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873" } ], "release_date": "2023-07-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tough-cookie: prototype pollution in cookie memstore" }, { "cve": "CVE-2023-26464", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182864" } ], "notes": [ { "category": "description", "text": "A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.", "title": "Vulnerability description" }, { "category": "summary", "text": "log4j1-socketappender: DoS via hashmap logging", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux 8 and 9 security impacts have been reduced to Low as they do not enable the vulnerable JDK by default.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26464" }, { "category": "external", "summary": "RHBZ#2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26464", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464" }, { "category": "external", "summary": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464", "url": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464" } ], "release_date": "2023-03-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "EAP 7.4.13" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "log4j1-socketappender: DoS via hashmap logging" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "EAP 7.4.13" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:18:28+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "EAP 7.4.13" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5488" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "EAP 7.4.13" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "EAP 7.4.13" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2023_5484
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)\n\n* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor (CVE-2023-4061)\n\n* tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5484", "url": "https://access.redhat.com/errata/RHSA-2023:5484" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "JBEAP-24667", "url": "https://issues.redhat.com/browse/JBEAP-24667" }, { "category": "external", "summary": "JBEAP-24797", "url": "https://issues.redhat.com/browse/JBEAP-24797" }, { "category": "external", "summary": "JBEAP-24966", "url": "https://issues.redhat.com/browse/JBEAP-24966" }, { "category": "external", "summary": "JBEAP-24985", "url": "https://issues.redhat.com/browse/JBEAP-24985" }, { "category": "external", "summary": "JBEAP-25032", "url": "https://issues.redhat.com/browse/JBEAP-25032" }, { "category": "external", "summary": "JBEAP-25033", "url": "https://issues.redhat.com/browse/JBEAP-25033" }, { "category": "external", "summary": "JBEAP-25078", "url": "https://issues.redhat.com/browse/JBEAP-25078" }, { "category": "external", "summary": "JBEAP-25122", "url": "https://issues.redhat.com/browse/JBEAP-25122" }, { "category": "external", "summary": "JBEAP-25135", "url": "https://issues.redhat.com/browse/JBEAP-25135" }, { "category": "external", "summary": "JBEAP-25186", "url": "https://issues.redhat.com/browse/JBEAP-25186" }, { "category": "external", "summary": "JBEAP-25200", "url": "https://issues.redhat.com/browse/JBEAP-25200" }, { "category": "external", "summary": "JBEAP-25225", "url": "https://issues.redhat.com/browse/JBEAP-25225" }, { "category": "external", "summary": "JBEAP-25261", "url": "https://issues.redhat.com/browse/JBEAP-25261" }, { "category": "external", "summary": "JBEAP-25285", "url": "https://issues.redhat.com/browse/JBEAP-25285" }, { "category": "external", "summary": "JBEAP-25312", "url": "https://issues.redhat.com/browse/JBEAP-25312" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5484.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7", "tracking": { "current_release_date": "2024-11-06T03:46:35+00:00", "generator": { "date": "2024-11-06T03:46:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5484", "initial_release_date": "2023-10-05T20:23:52+00:00", "revision_history": [ { "date": "2023-10-05T20:23:52+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-10-05T20:23:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:46:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el7eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.20-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling-river@2.0.13-2.SP1_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-all@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-buffer@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-dns@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-haproxy@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http2@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-memcache@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-mqtt@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-redis@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-smtp@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-socks@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-stomp@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-xml@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-common@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler-proxy@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns-classes-macos@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-epoll@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-kqueue@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-unix-common@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-rxtx@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-sctp@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-udt@4.1.94-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-atom-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-cdi@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-client@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-crypto@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson2-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxb-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxrs@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jettison-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jose-jwt@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jsapi@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-binding-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-p-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-multipart-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-rxjava2@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-spring@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-validator-provider-11@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-yaml-provider@3.15.8-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-31.Final_redhat_00030.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-31.Final_redhat_00030.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-core@5.3.31-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-entitymanager@5.3.31-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-envers@5.3.31-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-java8@5.3.31-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.15-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-cli@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-commons@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-core-client@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-dto@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hornetq-protocol@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hqclient-protocol@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jdbc-store@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-client@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-server@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-journal@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-ra@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-selector@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-server@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-service-extensions@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_id": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-tools@2.16.0-15.redhat_00049.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-mail@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pg@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pkix@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-prov@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_id": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-util@1.76.0-4.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.13-8.GA_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.13-8.GA_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.13-8.GA_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.13-8.GA_redhat_00001.1.el7eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el7eap?arch=x86_64" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll-debuginfo@4.1.94-1.Final_redhat_00001.1.el7eap?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch" }, "product_reference": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-25883", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-06-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216475" } ], "notes": [ { "category": "description", "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the \u0027new Range\u0027 function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-semver: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25883" }, { "category": "external", "summary": "RHBZ#2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795", "url": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795" } ], "release_date": "2023-06-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-semver: Regular expression denial of service" }, { "cve": "CVE-2023-3171", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "discovery_date": "2023-04-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2213639" } ], "notes": [ { "category": "description", "text": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "eap-7: heap exhaustion via deserialization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3171" }, { "category": "external", "summary": "RHBZ#2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3171", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3171" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "eap-7: heap exhaustion via deserialization" }, { "cve": "CVE-2023-4061", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-08-02T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2228608" } ], "notes": [ { "category": "description", "text": "A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability requires a malicious user to previously have access to the system, especially access to the HAL interface via browser and logged with a management user who have access to the resolve-expression method, hence the moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-4061" }, { "category": "external", "summary": "RHBZ#2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-4061", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4061" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" }, { "category": "workaround", "details": "Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor" }, { "acknowledgments": [ { "names": [ "Kokorin Vsevolod" ] } ], "cve": "CVE-2023-26136", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2023-07-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2219310" } ], "notes": [ { "category": "description", "text": "A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.", "title": "Vulnerability description" }, { "category": "summary", "text": "tough-cookie: prototype pollution in cookie memstore", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26136" }, { "category": "external", "summary": "RHBZ#2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26136", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26136" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e", "url": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/issues/282", "url": "https://github.com/salesforce/tough-cookie/issues/282" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3", "url": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873", "url": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873" } ], "release_date": "2023-07-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tough-cookie: prototype pollution in cookie memstore" }, { "cve": "CVE-2023-26464", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182864" } ], "notes": [ { "category": "description", "text": "A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.", "title": "Vulnerability description" }, { "category": "summary", "text": "log4j1-socketappender: DoS via hashmap logging", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux 8 and 9 security impacts have been reduced to Low as they do not enable the vulnerable JDK by default.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26464" }, { "category": "external", "summary": "RHBZ#2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26464", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464" }, { "category": "external", "summary": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464", "url": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464" } ], "release_date": "2023-03-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "log4j1-socketappender: DoS via hashmap logging" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T20:23:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5484" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src", "7Server-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el7eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el7eap.x86_64", "7Server-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el7eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2023_7488
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.6 serves as a replacement for Red Hat Single Sign-On 7.6.5, and includes bug fixes and enhancements.\n\nSecurity Fix(es):\n\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n* keycloak: impersonation and lockout possible through incorrect handling of email trust (CVE-2023-0105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7488", "url": "https://access.redhat.com/errata/RHSA-2023:7488" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso\u0026downloadType=patches\u0026version=7.6", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso\u0026downloadType=patches\u0026version=7.6" }, { "category": "external", "summary": "2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7488.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update", "tracking": { "current_release_date": "2024-11-06T04:24:42+00:00", "generator": { "date": "2024-11-06T04:24:42+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7488", "initial_release_date": "2023-11-24T16:57:47+00:00", "revision_history": [ { "date": "2023-11-24T16:57:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-24T16:57:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:24:42+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7", "product": { "name": "Red Hat Single Sign-On 7", "product_id": "Red Hat Single Sign-On 7", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6.6" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Willem Noort" ], "organization": "Inverid", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0105", "cwe": { "id": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158910" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: impersonation and lockout possible through incorrect handling of email trust", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0105" }, { "category": "external", "summary": "RHBZ#2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj", "url": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj" } ], "release_date": "2023-01-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:57:47+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: impersonation and lockout possible through incorrect handling of email trust" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:57:47+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7488" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-10-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242803" } ], "notes": [ { "category": "description", "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "title": "Vulnerability summary" }, { "category": "other", "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44487" }, { "category": "external", "summary": "RHBZ#2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "external", "summary": "RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "category": "external", "summary": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2102", "url": "https://pkg.go.dev/vuln/GO-2023-2102" }, { "category": "external", "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "category": "external", "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2023-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:57:47+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7488" }, { "category": "workaround", "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.", "product_ids": [ "Red Hat Single Sign-On 7" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "exploit_status", "date": "2023-10-10T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)" } ] }
rhsa-2023_5485
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)\n\n* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor (CVE-2023-4061)\n\n* tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5485", "url": "https://access.redhat.com/errata/RHSA-2023:5485" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "JBEAP-24667", "url": "https://issues.redhat.com/browse/JBEAP-24667" }, { "category": "external", "summary": "JBEAP-24798", "url": "https://issues.redhat.com/browse/JBEAP-24798" }, { "category": "external", "summary": "JBEAP-24966", "url": "https://issues.redhat.com/browse/JBEAP-24966" }, { "category": "external", "summary": "JBEAP-24985", "url": "https://issues.redhat.com/browse/JBEAP-24985" }, { "category": "external", "summary": "JBEAP-25032", "url": "https://issues.redhat.com/browse/JBEAP-25032" }, { "category": "external", "summary": "JBEAP-25033", "url": "https://issues.redhat.com/browse/JBEAP-25033" }, { "category": "external", "summary": "JBEAP-25078", "url": "https://issues.redhat.com/browse/JBEAP-25078" }, { "category": "external", "summary": "JBEAP-25122", "url": "https://issues.redhat.com/browse/JBEAP-25122" }, { "category": "external", "summary": "JBEAP-25135", "url": "https://issues.redhat.com/browse/JBEAP-25135" }, { "category": "external", "summary": "JBEAP-25186", "url": "https://issues.redhat.com/browse/JBEAP-25186" }, { "category": "external", "summary": "JBEAP-25200", "url": "https://issues.redhat.com/browse/JBEAP-25200" }, { "category": "external", "summary": "JBEAP-25225", "url": "https://issues.redhat.com/browse/JBEAP-25225" }, { "category": "external", "summary": "JBEAP-25261", "url": "https://issues.redhat.com/browse/JBEAP-25261" }, { "category": "external", "summary": "JBEAP-25285", "url": "https://issues.redhat.com/browse/JBEAP-25285" }, { "category": "external", "summary": "JBEAP-25312", "url": "https://issues.redhat.com/browse/JBEAP-25312" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5485.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8", "tracking": { "current_release_date": "2024-11-06T03:47:32+00:00", "generator": { "date": "2024-11-06T03:47:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5485", "initial_release_date": "2023-10-06T07:21:50+00:00", "revision_history": [ { "date": "2023-10-06T07:21:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-10-06T07:21:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:47:32+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 8", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el8eap?arch=src" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el8eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-atom-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-cdi@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-client@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-crypto@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jackson2-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxb-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jaxrs@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jettison-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jose-jwt@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-jsapi@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-binding-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-json-p-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-multipart-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-rxjava2@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-spring@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-validator-provider-11@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-resteasy-yaml-provider@3.15.8-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-31.Final_redhat_00030.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-31.Final_redhat_00030.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-31.Final_redhat_00030.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product_id": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.13-2.SP1_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product_id": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-marshalling-river@2.0.13-2.SP1_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-all@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-buffer@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-dns@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-haproxy@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-http2@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-memcache@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-mqtt@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-redis@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-smtp@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-socks@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-stomp@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-codec-xml@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-common@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-handler-proxy@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-resolver-dns-classes-macos@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-epoll@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-classes-kqueue@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-unix-common@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-rxtx@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-sctp@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-udt@4.1.94-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.8.10-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-mod_cluster@1.4.5-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.20-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.20-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate@5.3.31-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-core@5.3.31-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-entitymanager@5.3.31-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-envers@5.3.31-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-java8@5.3.31-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.19-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.15-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-cli@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-commons@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-core-client@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-dto@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hornetq-protocol@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-hqclient-protocol@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jdbc-store@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-client@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-server@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-journal@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-ra@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-selector@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-server@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-service-extensions@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_id": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-activemq-artemis-tools@2.16.0-15.redhat_00049.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-mail@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pg@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-pkix@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-prov@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_id": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-bouncycastle-util@1.76.0-4.redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk17@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.13-8.GA_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "product_id": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-modules@1.12.2-1.Final_redhat_00001.1.el8eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "product": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "product_id": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.26-1.SP1_redhat_00001.1.el8eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.94-1.Final_redhat_00001.1.el8eap?arch=x86_64" } } }, { "category": "product_version", "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product_id": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll-debuginfo@4.1.94-1.Final_redhat_00001.1.el8eap?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src" }, "product_reference": "eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch" }, "product_reference": "eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src" }, "product_reference": "eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64" }, "product_reference": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 8", "product_id": "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "relates_to_product_reference": "8Base-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-25883", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-06-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216475" } ], "notes": [ { "category": "description", "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the \u0027new Range\u0027 function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-semver: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25883" }, { "category": "external", "summary": "RHBZ#2216475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216475" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795", "url": "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795" } ], "release_date": "2023-06-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-semver: Regular expression denial of service" }, { "cve": "CVE-2023-3171", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "discovery_date": "2023-04-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2213639" } ], "notes": [ { "category": "description", "text": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "eap-7: heap exhaustion via deserialization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3171" }, { "category": "external", "summary": "RHBZ#2213639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3171", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3171" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "eap-7: heap exhaustion via deserialization" }, { "cve": "CVE-2023-4061", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-08-02T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2228608" } ], "notes": [ { "category": "description", "text": "A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability requires a malicious user to previously have access to the system, especially access to the HAL interface via browser and logged with a management user who have access to the resolve-expression method, hence the moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "known_not_affected": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-4061" }, { "category": "external", "summary": "RHBZ#2228608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-4061", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4061" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4061" } ], "release_date": "2023-10-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" }, { "category": "workaround", "details": "Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor" }, { "acknowledgments": [ { "names": [ "Kokorin Vsevolod" ] } ], "cve": "CVE-2023-26136", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2023-07-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2219310" } ], "notes": [ { "category": "description", "text": "A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.", "title": "Vulnerability description" }, { "category": "summary", "text": "tough-cookie: prototype pollution in cookie memstore", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26136" }, { "category": "external", "summary": "RHBZ#2219310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219310" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26136", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26136" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e", "url": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/issues/282", "url": "https://github.com/salesforce/tough-cookie/issues/282" }, { "category": "external", "summary": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3", "url": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873", "url": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873" } ], "release_date": "2023-07-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tough-cookie: prototype pollution in cookie memstore" }, { "cve": "CVE-2023-26464", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182864" } ], "notes": [ { "category": "description", "text": "A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.", "title": "Vulnerability description" }, { "category": "summary", "text": "log4j1-socketappender: DoS via hashmap logging", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux 8 and 9 security impacts have been reduced to Low as they do not enable the vulnerable JDK by default.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26464" }, { "category": "external", "summary": "RHBZ#2182864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26464", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464" }, { "category": "external", "summary": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464", "url": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464" } ], "release_date": "2023-03-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "log4j1-socketappender: DoS via hashmap logging" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch" ], "known_not_affected": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" ], "known_not_affected": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-10-06T07:21:50+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5485" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap.src", "8Base-JBEAP-7.4:eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-entitymanager-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-envers-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-hibernate-java8-0:5.3.31-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.15-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-marshalling-river-0:2.0.13-2.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap.src", "8Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-31.Final_redhat_00030.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-resteasy-atom-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-cdi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-client-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-crypto-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jackson2-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxb-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jaxrs-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jettison-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jose-jwt-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-jsapi-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-binding-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-json-p-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-multipart-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-rxjava2-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-spring-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-validator-provider-11-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-resteasy-yaml-provider-0:3.15.8-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.20-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk17-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.13-8.GA_redhat_00001.1.el8eap.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-all-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-buffer-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-haproxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-http2-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-memcache-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-mqtt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-redis-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-smtp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-socks-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-stomp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-codec-xml-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-handler-proxy-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-resolver-dns-classes-macos-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-classes-kqueue-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.src", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-epoll-debuginfo-0:4.1.94-1.Final_redhat_00001.1.el8eap.x86_64", "8Base-JBEAP-7.4:eap7-netty-transport-native-unix-common-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-rxtx-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-sctp-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch", "8Base-JBEAP-7.4:eap7-netty-transport-udt-0:4.1.94-1.Final_redhat_00001.1.el8eap.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2024_3527
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat AMQ Streams 2.7.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. \n\nThis release of Red Hat AMQ Streams 2.7.0 serves as a replacement for Red Hat AMQ Streams 2.6.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n\n* lz4: memory corruption due to an integer overflow bug caused by memmove argument (CVE-2021-3520)\n* zstd: Race condition allows attacker to access world-readable destination file (CVE-2021-24032)\n* RocksDB: zstd: mysql: buffer overrun in util.c (CVE-2022-4899)\n* netty-codec-http: Allocation of Resources Without Limits or Throttling (CVE-2024-29025)\n* commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file (CVE-2024-25710)\n* apache-commons-text: variable interpolation RCE (CVE-2022-42889)\n* snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact (CVE-2023-43642)\n* json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) (CVE-2023-1370)\n* protobuf-java: timeout in parser leads to DoS (CVE-2022-3171)\n* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)\n* bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class (CVE-2023-33202)\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n* json-path: stack-based buffer overflow in Criteria.parse method (CVE-2023-51074)\n* guava: insecure temporary directory creation (CVE-2023-2976)\n* io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support (CVE-2024-1300)\n* io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx (CVE-2024-1023)\n* quarkus-core: Leak of local configuration properties into Quarkus applications (CVE-2024-2700)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:3527", "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1928090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928090" }, { "category": "external", "summary": "1954559", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954559" }, { "category": "external", "summary": "2135435", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435" }, { "category": "external", "summary": "2137645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137645" }, { "category": "external", "summary": "2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "2179864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179864" }, { "category": "external", "summary": "2188542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542" }, { "category": "external", "summary": "2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2241722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241722" }, { "category": "external", "summary": "2251281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251281" }, { "category": "external", "summary": "2256063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256063" }, { "category": "external", "summary": "2260840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260840" }, { "category": "external", "summary": "2263139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2263139" }, { "category": "external", "summary": "2264988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264988" }, { "category": "external", "summary": "2272907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907" }, { "category": "external", "summary": "2273281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273281" }, { "category": "external", "summary": "ENTMQST-5619", "url": "https://issues.redhat.com/browse/ENTMQST-5619" }, { "category": "external", "summary": "ENTMQST-5881", "url": "https://issues.redhat.com/browse/ENTMQST-5881" }, { "category": "external", "summary": "ENTMQST-5882", "url": "https://issues.redhat.com/browse/ENTMQST-5882" }, { "category": "external", "summary": "ENTMQST-5883", "url": "https://issues.redhat.com/browse/ENTMQST-5883" }, { "category": "external", "summary": "ENTMQST-5884", "url": "https://issues.redhat.com/browse/ENTMQST-5884" }, { "category": "external", "summary": "ENTMQST-5885", "url": "https://issues.redhat.com/browse/ENTMQST-5885" }, { "category": "external", "summary": "ENTMQST-5886", "url": "https://issues.redhat.com/browse/ENTMQST-5886" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3527.json" } ], "title": "Red Hat Security Advisory: Red Hat AMQ Streams 2.7.0 release and security update", "tracking": { "current_release_date": "2024-11-06T15:08:10+00:00", "generator": { "date": "2024-11-06T15:08:10+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:3527", "initial_release_date": "2024-05-30T20:24:46+00:00", "revision_history": [ { "date": "2024-05-30T20:24:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-06-25T17:26:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T15:08:10+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Streams 2.7.0", "product": { "name": "Red Hat AMQ Streams 2.7.0", "product_id": "Red Hat AMQ Streams 2.7.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:2" } } } ], "category": "product_family", "name": "Streams for Apache Kafka" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3520", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2021-03-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1954559" } ], "notes": [ { "category": "description", "text": "There\u0027s a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.", "title": "Vulnerability description" }, { "category": "summary", "text": "lz4: memory corruption due to an integer overflow bug caused by memmove argument", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for Red Hat Enterprise Linux 7. To learn more about Red Hat Enterprise Linux support life cycles, please see https://access.redhat.com/support/policy/updates/errata .", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3520" }, { "category": "external", "summary": "RHBZ#1954559", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954559" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3520", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3520" } ], "release_date": "2021-04-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "lz4: memory corruption due to an integer overflow bug caused by memmove argument" }, { "cve": "CVE-2021-24032", "cwe": { "id": "CWE-281", "name": "Improper Preservation of Permissions" }, "discovery_date": "2021-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1928090" } ], "notes": [ { "category": "description", "text": "A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues (especially if large files are being handled).", "title": "Vulnerability description" }, { "category": "summary", "text": "zstd: Race condition allows attacker to access world-readable destination file", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP) the zstd package was delivered in OCP 4.3 which is already end of life.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-24032" }, { "category": "external", "summary": "RHBZ#1928090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-24032", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24032" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-24032", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24032" } ], "release_date": "2021-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "zstd: Race condition allows attacker to access world-readable destination file" }, { "cve": "CVE-2022-3171", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2137645" } ], "notes": [ { "category": "description", "text": "A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.", "title": "Vulnerability description" }, { "category": "summary", "text": "protobuf-java: timeout in parser leads to DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3171" }, { "category": "external", "summary": "RHBZ#2137645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3171", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3171" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171" }, { "category": "external", "summary": "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2", "url": "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2" } ], "release_date": "2022-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "protobuf-java: timeout in parser leads to DoS" }, { "cve": "CVE-2022-4899", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2179864" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.", "title": "Vulnerability description" }, { "category": "summary", "text": "zstd: mysql: buffer overrun in util.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4899" }, { "category": "external", "summary": "RHBZ#2179864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4899", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4899" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899" } ], "release_date": "2022-07-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "zstd: mysql: buffer overrun in util.c" }, { "cve": "CVE-2022-42889", "cwe": { "id": "CWE-1188", "name": "Initialization of a Resource with an Insecure Default" }, "discovery_date": "2022-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135435" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-text: variable interpolation RCE", "title": "Vulnerability summary" }, { "category": "other", "text": "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n - Usage of specific methods that interpolate the variables as described in the flaw\n - Usage of external input for those methods\n - Usage of that external input has to be unsanitized/no \"allow list\"/etc.\n\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\n\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42889" }, { "category": "external", "summary": "RHBZ#2135435", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42889", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42889" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889" }, { "category": "external", "summary": "https://blogs.apache.org/security/entry/cve-2022-42889", "url": "https://blogs.apache.org/security/entry/cve-2022-42889" }, { "category": "external", "summary": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om", "url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om" }, { "category": "external", "summary": "https://seclists.org/oss-sec/2022/q4/22", "url": "https://seclists.org/oss-sec/2022/q4/22" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "apache-commons-text: variable interpolation RCE" }, { "cve": "CVE-2022-42920", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2142707" } ], "notes": [ { "category": "description", "text": "An out-of-bounds (OOB) write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected.", "title": "Vulnerability description" }, { "category": "summary", "text": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing", "title": "Vulnerability summary" }, { "category": "other", "text": "Fuse 7 ships the code in question but does not utilize it in the product, so it is affected at a reduced impact of Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42920" }, { "category": "external", "summary": "RHBZ#2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42920", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920" }, { "category": "external", "summary": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4", "url": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing" }, { "cve": "CVE-2023-1370", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "discovery_date": "2023-04-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2188542" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json-smart package. This security flaw occurs when reaching a \u2018[\u2018 or \u2018{\u2018 character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.", "title": "Vulnerability description" }, { "category": "summary", "text": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-1370" }, { "category": "external", "summary": "RHBZ#2188542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-1370", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-493p-pfq6-5258", "url": "https://github.com/advisories/GHSA-493p-pfq6-5258" }, { "category": "external", "summary": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/", "url": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/" } ], "release_date": "2023-03-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)" }, { "cve": "CVE-2023-2976", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "discovery_date": "2023-06-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215229" } ], "notes": [ { "category": "description", "text": "A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.", "title": "Vulnerability description" }, { "category": "summary", "text": "guava: insecure temporary directory creation", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Single Sign-On 7 ships the affected component as a layered product of Red Hat JBoss Enterprise Application 7, and as such is affected by this flaw. However, Single Sign-On 7 does not use the affected code and is not vulnerable to exploit.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-2976" }, { "category": "external", "summary": "RHBZ#2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-2976", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" } ], "release_date": "2023-06-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "guava: insecure temporary directory creation" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-33202", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2251281" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle for the Java pkix module, which is vulnerable to a potential Denial of Service (DoS) issue within the org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33202" }, { "category": "external", "summary": "RHBZ#2251281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251281" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33202", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33202" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33202", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33202" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33202", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33202" } ], "release_date": "2023-11-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class" }, { "cve": "CVE-2023-43642", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2241722" } ], "notes": [ { "category": "description", "text": "A flaw was found in SnappyInputStream in snappy-java, a data compression library in Java. This issue occurs when decompressing data with a too-large chunk size due to a missing upper bound check on chunk length. An unrecoverable fatal error can occur, resulting in a Denial of Service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-43642" }, { "category": "external", "summary": "RHBZ#2241722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241722" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-43642", "url": "https://www.cve.org/CVERecord?id=CVE-2023-43642" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-43642", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43642" }, { "category": "external", "summary": "https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv", "url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv" } ], "release_date": "2023-09-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact" }, { "cve": "CVE-2023-51074", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "discovery_date": "2023-12-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2256063" } ], "notes": [ { "category": "description", "text": "A stack overflow vulnerability was found in the Criteria.parse() method in json-path. This issue occurs due to an uncontrolled recursion caused by specially crafted input, leading to a stack overflow. This vulnerability has the potential to trigger a crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "json-path: stack-based buffer overflow in Criteria.parse method", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat rates this at maximum of a Moderate impact. When interacting with a server to explore this possible vulnerability, the attacker would be the only one seeing a HTTP 500 error and no other user (or the server entirely) would be vulnerable in a real application scenario with multi-threads.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-51074" }, { "category": "external", "summary": "RHBZ#2256063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256063" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-51074", "url": "https://www.cve.org/CVERecord?id=CVE-2023-51074" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-51074", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51074" }, { "category": "external", "summary": "https://github.com/json-path/JsonPath/issues/973", "url": "https://github.com/json-path/JsonPath/issues/973" } ], "release_date": "2023-12-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json-path: stack-based buffer overflow in Criteria.parse method" }, { "cve": "CVE-2024-1023", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2024-01-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2260840" } ], "notes": [ { "category": "description", "text": "A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.", "title": "Vulnerability description" }, { "category": "summary", "text": "io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-1023" }, { "category": "external", "summary": "RHBZ#2260840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-1023", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1023" }, { "category": "external", "summary": "https://github.com/eclipse-vertx/vert.x/issues/5078", "url": "https://github.com/eclipse-vertx/vert.x/issues/5078" }, { "category": "external", "summary": "https://github.com/eclipse-vertx/vert.x/pull/5080", "url": "https://github.com/eclipse-vertx/vert.x/pull/5080" }, { "category": "external", "summary": "https://github.com/eclipse-vertx/vert.x/pull/5082", "url": "https://github.com/eclipse-vertx/vert.x/pull/5082" } ], "release_date": "2024-01-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx" }, { "cve": "CVE-2024-1300", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2024-02-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2263139" } ], "notes": [ { "category": "description", "text": "A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.", "title": "Vulnerability description" }, { "category": "summary", "text": "io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support", "title": "Vulnerability summary" }, { "category": "other", "text": "This affects only TLS servers with SNI enabled.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-1300" }, { "category": "external", "summary": "RHBZ#2263139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2263139" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-1300", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1300" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1300", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1300" }, { "category": "external", "summary": "https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni.", "url": "https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni." } ], "release_date": "2024-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support" }, { "cve": "CVE-2024-2700", "cwe": { "id": "CWE-526", "name": "Cleartext Storage of Sensitive Information in an Environment Variable" }, "discovery_date": "2024-04-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2273281" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application\u0027s build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.", "title": "Vulnerability description" }, { "category": "summary", "text": "quarkus-core: Leak of local configuration properties into Quarkus applications", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat rates this as a Moderate impact vulnerability since this requires an attacker to have direct access to the environment variables to override, and the application must use that environment variable to be jeopardized.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-2700" }, { "category": "external", "summary": "RHBZ#2273281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273281" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-2700", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2700" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-2700", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2700" } ], "release_date": "2024-04-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Currently, no mitigation is available for this vulnerability. Please update as the patches become available.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "quarkus-core: Leak of local configuration properties into Quarkus applications" }, { "cve": "CVE-2024-25710", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2024-02-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2264988" } ], "notes": [ { "category": "description", "text": "A loop with an unreachable exit condition (Infinite Loop) vulnerability was found in Apache Common Compress. This issue can lead to a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-25710" }, { "category": "external", "summary": "RHBZ#2264988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264988" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-25710", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25710" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/02/19/1", "url": "http://www.openwall.com/lists/oss-security/2024/02/19/1" }, { "category": "external", "summary": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf", "url": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf" } ], "release_date": "2024-02-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "No mitigation is currently available for this vulnerability.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file" }, { "cve": "CVE-2024-29025", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2024-04-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2272907" } ], "notes": [ { "category": "description", "text": "A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, allowing data to accumulate without limits. This flaw allows an attacker to cause a denial of service by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty-codec-http: Allocation of Resources Without Limits or Throttling", "title": "Vulnerability summary" }, { "category": "other", "text": "The vulnerability in io.netty:netty-codec-http, allowing for Allocation of Resources Without Limits or Throttling issues, is assessed as moderate severity due to its potential impact on system availability and performance. By exploiting the flaw in HttpPostRequestDecoder, an attacker can craft chunked POST requests with numerous small fields, causing excessive accumulation of data in memory buffers. This unrestricted accumulation can lead to significant memory consumption on the server, potentially exhausting available resources and resulting in denial of service (DoS) conditions.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.7.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-29025" }, { "category": "external", "summary": "RHBZ#2272907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-29025", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025" }, { "category": "external", "summary": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3", "url": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3" }, { "category": "external", "summary": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c", "url": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c" }, { "category": "external", "summary": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", "url": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812", "url": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812" } ], "release_date": "2024-03-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-30T20:24:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3527" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat AMQ Streams 2.7.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.7.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty-codec-http: Allocation of Resources Without Limits or Throttling" } ] }
rhsa-2023_7482
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.6 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.5, and includes bug fixes and enhancements.\n\nSecurity Fix(es):\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n* keycloak: impersonation and lockout possible through incorrect handling of email trust (CVE-2023-0105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7482", "url": "https://access.redhat.com/errata/RHSA-2023:7482" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7482.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 7", "tracking": { "current_release_date": "2024-11-06T04:24:51+00:00", "generator": { "date": "2024-11-06T04:24:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7482", "initial_release_date": "2023-11-24T16:56:09+00:00", "revision_history": [ { "date": "2023-11-24T16:56:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-24T16:56:09+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:24:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el7sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el7sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.11-2.redhat_00001.1.el7sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Willem Noort" ], "organization": "Inverid", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0105", "cwe": { "id": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158910" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: impersonation and lockout possible through incorrect handling of email trust", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0105" }, { "category": "external", "summary": "RHBZ#2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj", "url": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj" } ], "release_date": "2023-01-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7482" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: impersonation and lockout possible through incorrect handling of email trust" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7482" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-10-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242803" } ], "notes": [ { "category": "description", "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "title": "Vulnerability summary" }, { "category": "other", "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44487" }, { "category": "external", "summary": "RHBZ#2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "external", "summary": "RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "category": "external", "summary": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2102", "url": "https://pkg.go.dev/vuln/GO-2023-2102" }, { "category": "external", "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "category": "external", "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2023-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:09+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7482" }, { "category": "workaround", "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2023-10-10T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)" } ] }
rhsa-2023_5165
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency.\n\nSecurity Fix(es):\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n \n* scala: deserialization gadget chain (CVE-2022-36944)\n\n* DoS of the Okio client when handling a crafted GZIP archive (CVE-2023-3635)\n \n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* netty: world readable temporary file containing sensitive data (CVE-2022-24823)\n\n* guava: insecure temporary directory creation (CVE-2023-2976)\n\n* Jetty servlets with multipart support may cause OOM error with client requests (CVE-2023-26048)\n\n* Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies (CVE-2023-26049)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* snappy-java: Integer overflow in shuffle leads to DoS (CVE-2023-34453)\n\n* snappy-java: Integer overflow in compress leads to DoS (CVE-2023-34454)\n\n* snappy-java: Unchecked chunk length leads to DoS (CVE-2023-34455)\n\n* Flaw in Netty\u0027s SniHandler while navigating TLS handshake; DoS (CVE-2023-34462)\n\n* RESTEasy: creation of insecure temp files (CVE-2023-0482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:5165", "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.5.0", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.5.0" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5", "url": "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5" }, { "category": "external", "summary": "2004133", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133" }, { "category": "external", "summary": "2004135", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135" }, { "category": "external", "summary": "2087186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2087186" }, { "category": "external", "summary": "2129809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129809" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2166004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004" }, { "category": "external", "summary": "2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "2215393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215393" }, { "category": "external", "summary": "2215394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215394" }, { "category": "external", "summary": "2215445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "2229295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295" }, { "category": "external", "summary": "2236340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236340" }, { "category": "external", "summary": "2236341", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236341" }, { "category": "external", "summary": "ENTMQST-5081", "url": "https://issues.redhat.com/browse/ENTMQST-5081" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5165.json" } ], "title": "Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update", "tracking": { "current_release_date": "2024-11-06T03:40:58+00:00", "generator": { "date": "2024-11-06T03:40:58+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:5165", "initial_release_date": "2023-09-14T09:51:43+00:00", "revision_history": [ { "date": "2023-09-14T09:51:43+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-09-14T09:51:43+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:40:58+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Streams 2.5.0", "product": { "name": "Red Hat AMQ Streams 2.5.0", "product_id": "Red Hat AMQ Streams 2.5.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:2" } } } ], "category": "product_family", "name": "Streams for Apache Kafka" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-37136", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2004133" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data", "title": "Vulnerability summary" }, { "category": "other", "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37136" }, { "category": "external", "summary": "RHBZ#2004133", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, { "category": "external", "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv", "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv" } ], "release_date": "2021-09-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data" }, { "cve": "CVE-2021-37137", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2004135" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37137" }, { "category": "external", "summary": "RHBZ#2004135", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, { "category": "external", "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv", "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv" } ], "release_date": "2021-09-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-24823", "cwe": { "id": "CWE-379", "name": "Creation of Temporary File in Directory with Insecure Permissions" }, "discovery_date": "2022-05-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2087186" } ], "notes": [ { "category": "description", "text": "CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: world readable temporary file containing sensitive data", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.\n\nRed Hat Satellite 6 is not affected as is using netty 3.6.7 version which is not impacted by this vulnerability.\n\nRed Hat Fuse 7 is now in Maintenance Support Phase and should be fixed soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24823" }, { "category": "external", "summary": "RHBZ#2087186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2087186" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24823", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24823" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24823", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24823" } ], "release_date": "2022-05-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "workaround", "details": "As a workaround, specify one\u0027s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: world readable temporary file containing sensitive data" }, { "cve": "CVE-2022-36944", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129809" } ], "notes": [ { "category": "description", "text": "A flaw was found in Scala\u0027s LazyList that permits code execution during deserialization. This issue could allow an attacker to craft a LazyList containing a malicious Function0 call to execute arbitrary code on a server that deserializes untrusted data.", "title": "Vulnerability description" }, { "category": "summary", "text": "scala: deserialization gadget chain", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36944" }, { "category": "external", "summary": "RHBZ#2129809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129809" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36944", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36944" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36944", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36944" }, { "category": "external", "summary": "https://github.com/scala/scala/pull/10118", "url": "https://github.com/scala/scala/pull/10118" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "workaround", "details": "Users of Scala\u0027s LazyList should never permit deserialization of untrusted data.", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "scala: deserialization gadget chain" }, { "cve": "CVE-2023-0482", "cwe": { "id": "CWE-378", "name": "Creation of Temporary File With Insecure Permissions" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2166004" } ], "notes": [ { "category": "description", "text": "In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.", "title": "Vulnerability description" }, { "category": "summary", "text": "RESTEasy: creation of insecure temp files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0482" }, { "category": "external", "summary": "RHBZ#2166004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0482", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0482" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "RESTEasy: creation of insecure temp files" }, { "cve": "CVE-2023-2976", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "discovery_date": "2023-06-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215229" } ], "notes": [ { "category": "description", "text": "A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.", "title": "Vulnerability description" }, { "category": "summary", "text": "guava: insecure temporary directory creation", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Single Sign-On 7 ships the affected component as a layered product of Red Hat JBoss Enterprise Application 7, and as such is affected by this flaw. However, Single Sign-On 7 does not use the affected code and is not vulnerable to exploit.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-2976" }, { "category": "external", "summary": "RHBZ#2215229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-2976", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" } ], "release_date": "2023-06-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "workaround", "details": "Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "guava: insecure temporary directory creation" }, { "cve": "CVE-2023-3635", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "discovery_date": "2023-07-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2229295" } ], "notes": [ { "category": "description", "text": "A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "okio: GzipSource class improper exception handling", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat JBoss Enterprise Application Platform XP does contain Okio package but is not using GzipSource.java, which is the affected class.\nRed Hat support for Spring Boot is considered low impact as it\u0027s used by Dekorate during compilation process and not included in the resulting Jar.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3635" }, { "category": "external", "summary": "RHBZ#2229295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3635", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3635" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635" } ], "release_date": "2023-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "okio: GzipSource class improper exception handling" }, { "cve": "CVE-2023-26048", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-08-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2236340" } ], "notes": [ { "category": "description", "text": "A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable state.", "title": "Vulnerability description" }, { "category": "summary", "text": "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26048" }, { "category": "external", "summary": "RHBZ#2236340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236340" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26048", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26048", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26048" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8" } ], "release_date": "2023-04-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()" }, { "cve": "CVE-2023-26049", "cwe": { "id": "CWE-1286", "name": "Improper Validation of Syntactic Correctness of Input" }, "discovery_date": "2023-08-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2236341" } ], "notes": [ { "category": "description", "text": "A flaw was found in the jetty-server package. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.", "title": "Vulnerability description" }, { "category": "summary", "text": "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-26049" }, { "category": "external", "summary": "RHBZ#2236341", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236341" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26049", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26049", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26049" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c" } ], "release_date": "2023-04-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-34453", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2023-06-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215393" } ], "notes": [ { "category": "description", "text": "A flaw was found in Snappy-java\u0027s shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snappy-java: Integer overflow in shuffle leads to DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34453" }, { "category": "external", "summary": "RHBZ#2215393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215393" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34453", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34453" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34453", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34453" } ], "release_date": "2023-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snappy-java: Integer overflow in shuffle leads to DoS" }, { "cve": "CVE-2023-34454", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2023-06-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215394" } ], "notes": [ { "category": "description", "text": "A flaw was found in Snappy-java\u0027s shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snappy-java: Integer overflow in compress leads to DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34454" }, { "category": "external", "summary": "RHBZ#2215394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215394" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34454", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34454" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34454", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34454" } ], "release_date": "2023-06-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snappy-java: Integer overflow in compress leads to DoS" }, { "cve": "CVE-2023-34455", "cwe": { "id": "CWE-1285", "name": "Improper Validation of Specified Index, Position, or Offset in Input" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215445" } ], "notes": [ { "category": "description", "text": "A flaw was found in Snappy-java\u0027s fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snappy-java: Unchecked chunk length leads to DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34455" }, { "category": "external", "summary": "RHBZ#2215445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34455", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34455" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snappy-java: Unchecked chunk length leads to DoS" }, { "cve": "CVE-2023-34462", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2216888" } ], "notes": [ { "category": "description", "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "netty: SniHandler 16MB allocation leads to OOM", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat AMQ Streams 2.5.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-34462" }, { "category": "external", "summary": "RHBZ#2216888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462" } ], "release_date": "2023-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-09-14T09:51:43+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "workaround", "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.", "product_ids": [ "Red Hat AMQ Streams 2.5.0" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat AMQ Streams 2.5.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "netty: SniHandler 16MB allocation leads to OOM" } ] }
rhsa-2023_7483
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.6 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.5, and includes bug fixes and enhancements.\n\nSecurity Fix(es):\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n* keycloak: impersonation and lockout possible through incorrect handling of email trust (CVE-2023-0105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7483", "url": "https://access.redhat.com/errata/RHSA-2023:7483" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7483.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 8", "tracking": { "current_release_date": "2024-11-06T04:25:01+00:00", "generator": { "date": "2024-11-06T04:25:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7483", "initial_release_date": "2023-11-24T16:56:38+00:00", "revision_history": [ { "date": "2023-11-24T16:56:38+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-24T16:56:38+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:25:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 8", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el8sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.11-2.redhat_00001.1.el8sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.11-2.redhat_00001.1.el8sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "relates_to_product_reference": "8Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "relates_to_product_reference": "8Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "relates_to_product_reference": "8Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Willem Noort" ], "organization": "Inverid", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0105", "cwe": { "id": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158910" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: impersonation and lockout possible through incorrect handling of email trust", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0105" }, { "category": "external", "summary": "RHBZ#2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj", "url": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj" } ], "release_date": "2023-01-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7483" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: impersonation and lockout possible through incorrect handling of email trust" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7483" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-10-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242803" } ], "notes": [ { "category": "description", "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "title": "Vulnerability summary" }, { "category": "other", "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44487" }, { "category": "external", "summary": "RHBZ#2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "external", "summary": "RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "category": "external", "summary": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2102", "url": "https://pkg.go.dev/vuln/GO-2023-2102" }, { "category": "external", "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "category": "external", "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2023-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:56:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7483" }, { "category": "workaround", "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.11-2.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.11-2.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2023-10-10T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)" } ] }
rhsa-2023_7486
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A new image is available for Red Hat Single Sign-On 7.6.6, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat Single Sign-On for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\n\nThis erratum releases a new image for Red Hat Single Sign-On 7.6.6 for use within the OpenShift Container Platform 3.10, OpenShift Container Platform 3.11, and OpenShift Container Platform 4.3 cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity Fix(es):\n\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS\nattack (Rapid Reset Attack) (CVE-2023-44487)\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable\nto a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* bouncycastle: potential blind LDAP injection attack using a self-signed\ncertificate (CVE-2023-33201)\n* keycloak: impersonation and lockout possible through incorrect handling of\nemail trust (CVE-2023-0105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:7486", "url": "https://access.redhat.com/errata/RHSA-2023:7486" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7486.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update", "tracking": { "current_release_date": "2024-11-06T04:25:18+00:00", "generator": { "date": "2024-11-06T04:25:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:7486", "initial_release_date": "2023-11-24T16:53:18+00:00", "revision_history": [ { "date": "2023-11-24T16:53:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-24T16:53:18+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:25:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Middleware Containers for OpenShift", "product": { "name": "Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhosemc:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-36" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-36" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-36" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64 as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x", "relates_to_product_reference": "8Base-RHOSE-Middleware" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Willem Noort" ], "organization": "Inverid", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0105", "cwe": { "id": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158910" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: impersonation and lockout possible through incorrect handling of email trust", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0105" }, { "category": "external", "summary": "RHBZ#2158910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0105" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj", "url": "https://github.com/advisories/GHSA-c7xw-p58w-h6fj" } ], "release_date": "2023-01-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:53:18+00:00", "details": "To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content:\n\n1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global \"openshift\" project. For example:\n\n$ oc login -u system:admin\n\n2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the \"openshift\" project by running the following commands:\n\n$ for resource in sso76-image-stream.json \\\nsso76-https.json \\\nsso76-mysql.json \\\nsso76-mysql-persistent.json \\\nsso76-postgresql.json \\\nsso76-postgresql-persistent.json \\\nsso76-x509-https.json \\\nsso76-x509-mysql-persistent.json \\\nsso76-x509-postgresql-persistent.json\ndo\noc replace -n openshift --force -f \\\nhttps://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource}\ndone\n\n3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the \"openshift\" project by running the following command:\n\n$ oc -n openshift import-image redhat-sso76-openshift:1.0", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: impersonation and lockout possible through incorrect handling of email trust" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:53:18+00:00", "details": "To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content:\n\n1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global \"openshift\" project. For example:\n\n$ oc login -u system:admin\n\n2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the \"openshift\" project by running the following commands:\n\n$ for resource in sso76-image-stream.json \\\nsso76-https.json \\\nsso76-mysql.json \\\nsso76-mysql-persistent.json \\\nsso76-postgresql.json \\\nsso76-postgresql-persistent.json \\\nsso76-x509-https.json \\\nsso76-x509-mysql-persistent.json \\\nsso76-x509-postgresql-persistent.json\ndo\noc replace -n openshift --force -f \\\nhttps://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource}\ndone\n\n3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the \"openshift\" project by running the following command:\n\n$ oc -n openshift import-image redhat-sso76-openshift:1.0", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7486" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-10-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2242803" } ], "notes": [ { "category": "description", "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "title": "Vulnerability summary" }, { "category": "other", "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-44487" }, { "category": "external", "summary": "RHBZ#2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "category": "external", "summary": "RHSB-2023-003", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "category": "external", "summary": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2102", "url": "https://pkg.go.dev/vuln/GO-2023-2102" }, { "category": "external", "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "category": "external", "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2023-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-24T16:53:18+00:00", "details": "To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content:\n\n1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global \"openshift\" project. For example:\n\n$ oc login -u system:admin\n\n2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the \"openshift\" project by running the following commands:\n\n$ for resource in sso76-image-stream.json \\\nsso76-https.json \\\nsso76-mysql.json \\\nsso76-mysql-persistent.json \\\nsso76-postgresql.json \\\nsso76-postgresql-persistent.json \\\nsso76-x509-https.json \\\nsso76-x509-mysql-persistent.json \\\nsso76-x509-postgresql-persistent.json\ndo\noc replace -n openshift --force -f \\\nhttps://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource}\ndone\n\n3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the \"openshift\" project by running the following command:\n\n$ oc -n openshift import-image redhat-sso76-openshift:1.0", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:7486" }, { "category": "workaround", "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x" ] } ], "threats": [ { "category": "exploit_status", "date": "2023-10-10T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)" } ] }
rhsa-2024_1353
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat Process Automation Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which provides a detailed severity rating, is available for each vulnerability from the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nThis asynchronous security patch is an update to Red Hat Process Automation Manager 7.\n\nSecurity Fixes:\n\n* JSON-java: parser confusion leads to OOM (CVE-2023-5072)\n\n* okio: GzipSource class improper exception handling (CVE-2023-3635)\n\n* xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow (CVE-2022-41966)\n\n* batik: Server-Side Request Forgery vulnerability (CVE-2022-44729)\n\n* batik: Server-Side Request Forgery vulnerability (CVE-2022-44730)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151)\n\n* RESTEasy: creation of insecure temp files (CVE-2023-0482)\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n\nFor more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:1353", "url": "https://access.redhat.com/errata/RHSA-2024:1353" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2134292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134292" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2166004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004" }, { "category": "external", "summary": "2170431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170431" }, { "category": "external", "summary": "2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "2229295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295" }, { "category": "external", "summary": "2233889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233889" }, { "category": "external", "summary": "2233899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233899" }, { "category": "external", "summary": "2246417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246417" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1353.json" } ], "title": "Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.5 security update", "tracking": { "current_release_date": "2024-11-06T05:16:13+00:00", "generator": { "date": "2024-11-06T05:16:13+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:1353", "initial_release_date": "2024-03-18T09:47:51+00:00", "revision_history": [ { "date": "2024-03-18T09:47:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-03-18T09:47:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T05:16:13+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHPAM 7.13.5 async", "product": { "name": "RHPAM 7.13.5 async", "product_id": "RHPAM 7.13.5 async", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13" } } } ], "category": "product_family", "name": "Red Hat Process Automation Manager" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-40151", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134292" } ], "notes": [ { "category": "description", "text": "A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40151" }, { "category": "external", "summary": "RHBZ#2134292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134292" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40151", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40151" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40151", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40151" } ], "release_date": "2022-09-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks" }, { "cve": "CVE-2022-41966", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170431" } ], "notes": [ { "category": "description", "text": "A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow.", "title": "Vulnerability description" }, { "category": "summary", "text": "xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse 7 ships an affected version of XStream. No endpoint in any flavor of Fuse is accepting by default an unverified input stream passed directly to XStream unmarshaller. Documentation always recommend all the endpoints (TCP/UDP/HTTP(S)/other listeners) to have at least one layer of authentication/authorization and Fuse in general itself in particular has a lot of mechanisms to protect the endpoints.\n\nRed Hat Single Sign-On contains XStream as a transitive dependency from Infinispan and the same is not affected as NO_REFERENCE is in use.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41966" }, { "category": "external", "summary": "RHBZ#2170431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170431" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41966", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41966" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41966", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41966" }, { "category": "external", "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv", "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv" } ], "release_date": "2022-12-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "xstream: Denial of Service by injecting recursive collections or maps based on element\u0027s hash values raising a stack overflow" }, { "cve": "CVE-2022-44729", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2023-08-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2233889" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Server-Side Request Forgery vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-44729" }, { "category": "external", "summary": "RHBZ#2233889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233889" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-44729", "url": "https://www.cve.org/CVERecord?id=CVE-2022-44729" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-44729", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44729" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gq5f-xv48-2365", "url": "https://github.com/advisories/GHSA-gq5f-xv48-2365" }, { "category": "external", "summary": "https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2", "url": "https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2" } ], "release_date": "2023-08-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Server-Side Request Forgery vulnerability" }, { "cve": "CVE-2022-44730", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2023-08-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2233899" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Batik, where a malicious SVG can probe user profile data and send it directly as parameter to a URL. This issue can allow an attacker to conduct SSRF attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "batik: Server-Side Request Forgery vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-44730" }, { "category": "external", "summary": "RHBZ#2233899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2233899" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-44730", "url": "https://www.cve.org/CVERecord?id=CVE-2022-44730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-44730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44730" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-2474-2566-3qxp", "url": "https://github.com/advisories/GHSA-2474-2566-3qxp" }, { "category": "external", "summary": "https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0", "url": "https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0" } ], "release_date": "2023-08-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "batik: Server-Side Request Forgery vulnerability" }, { "cve": "CVE-2023-0482", "cwe": { "id": "CWE-378", "name": "Creation of Temporary File With Insecure Permissions" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2166004" } ], "notes": [ { "category": "description", "text": "In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.", "title": "Vulnerability description" }, { "category": "summary", "text": "RESTEasy: creation of insecure temp files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0482" }, { "category": "external", "summary": "RHBZ#2166004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0482", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0482" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "RESTEasy: creation of insecure temp files" }, { "cve": "CVE-2023-3635", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "discovery_date": "2023-07-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2229295" } ], "notes": [ { "category": "description", "text": "A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "okio: GzipSource class improper exception handling", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat JBoss Enterprise Application Platform XP does contain Okio package but is not using GzipSource.java, which is the affected class.\nRed Hat support for Spring Boot is considered low impact as it\u0027s used by Dekorate during compilation process and not included in the resulting Jar.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-3635" }, { "category": "external", "summary": "RHBZ#2229295", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3635", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3635" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635" } ], "release_date": "2023-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "okio: GzipSource class improper exception handling" }, { "cve": "CVE-2023-5072", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-10-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2246417" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.json package. A bug in the parser exists, and an input string may lead to undefined usage of memory, leading to an out-of-memory error, causing a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "JSON-java: parser confusion leads to OOM", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability may cause denial of service with a small string input, causing the server to be unresponsive easily, hence the Important impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-5072" }, { "category": "external", "summary": "RHBZ#2246417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246417" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-5072", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5072" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-5072", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5072" }, { "category": "external", "summary": "https://github.com/stleary/JSON-java/issues/758", "url": "https://github.com/stleary/JSON-java/issues/758" }, { "category": "external", "summary": "https://github.com/stleary/JSON-java/issues/771", "url": "https://github.com/stleary/JSON-java/issues/771" } ], "release_date": "2023-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" }, { "category": "workaround", "details": "No current mitigation is available for this flaw.", "product_ids": [ "RHPAM 7.13.5 async" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JSON-java: parser confusion leads to OOM" }, { "cve": "CVE-2023-6481", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-12-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2252956" } ], "notes": [ { "category": "description", "text": "A flaw was found in the logback package. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption (\u0027Resource Exhaustion\u0027) via the logback receiver component. This flaw allows an attacker to mount a denial-of-service attack by sending poisoned data.", "title": "Vulnerability description" }, { "category": "summary", "text": "logback: A serialization vulnerability in logback receiver", "title": "Vulnerability summary" }, { "category": "other", "text": "The security vulnerability in the logback package is considered of moderate severity due to its potential for facilitating a denial-of-service (DoS) attack. While a DoS attack can disrupt service availability, this vulnerability may not lead to more severe consequences such as unauthorized access or data breaches.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6481" }, { "category": "external", "summary": "RHBZ#2252956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2252956" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6481", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6481" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6481", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6481" } ], "release_date": "2023-12-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "RHPAM 7.13.5 async" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "logback: A serialization vulnerability in logback receiver" }, { "cve": "CVE-2023-6717", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2023-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2253952" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS via assertion consumer service URL in SAML POST-binding flow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6717" }, { "category": "external", "summary": "RHBZ#2253952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253952" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6717", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6717" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6717", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6717" } ], "release_date": "2024-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS via assertion consumer service URL in SAML POST-binding flow" }, { "cve": "CVE-2023-33201", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2215465" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "RHPAM 7.13.5 async" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-33201" }, { "category": "external", "summary": "RHBZ#2215465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "category": "external", "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" } ], "release_date": "2023-06-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-03-18T09:47:51+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "RHPAM 7.13.5 async" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1353" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "RHPAM 7.13.5 async" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bouncycastle: potential blind LDAP injection attack using a self-signed certificate" } ] }
ghsa-hr8g-6v94-x4m9
Vulnerability from github
Bouncy Castle provides the X509LDAPCertStoreSpi.java
class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure.
A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: CN=Subject*)(objectclass=
. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user.
Changes to the X509LDAPCertStoreSpi.java
class add the additional checking of any X.500 name used to correctly escape wild card characters.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk18on" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk15to18" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk14" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-ext-jdk14" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-ext-jdk15to18" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-ext-jdk18on" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-debug-jdk14" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-debug-jdk15to18" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-debug-jdk18on" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.74" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk15on" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "last_affected": "1.70" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-ext-jdk15on" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "last_affected": "1.70" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-debug-jdk15on" }, "ranges": [ { "events": [ { "introduced": "1.49" }, { "last_affected": "1.70" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2023-33201" ], "database_specific": { "cwe_ids": [ "CWE-295" ], "github_reviewed": true, "github_reviewed_at": "2023-07-06T15:40:29Z", "nvd_published_at": "2023-07-05T03:15:09Z", "severity": "MODERATE" }, "details": "Bouncy Castle provides the `X509LDAPCertStoreSpi.java` class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure.\n\nA potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: `CN=Subject*)(objectclass=`. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user.\n\nChanges to the `X509LDAPCertStoreSpi.java` class add the additional checking of any X.500 name used to correctly escape wild card characters.", "id": "GHSA-hr8g-6v94-x4m9", "modified": "2023-09-05T16:57:42Z", "published": "2023-07-05T03:30:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201" }, { "type": "WEB", "url": "https://github.com/bcgit/bc-java/commit/ccf93ca736b89250ff4ce079a5aa56f5cbf0ebbd" }, { "type": "WEB", "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc" }, { "type": "WEB", "url": "https://bouncycastle.org" }, { "type": "WEB", "url": "https://bouncycastle.org/releasenotes.html#r1rv74" }, { "type": "PACKAGE", "url": "https://github.com/bcgit/bc-java" }, { "type": "WEB", "url": "https://github.com/bcgit/bc-java/commits/main/prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java" }, { "type": "WEB", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230824-0008" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Bouncy Castle For Java LDAP injection vulnerability" }
wid-sec-w-2023-1490
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Bouncy Castle ist eine Kryptographie-API f\u00fcr Java.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Bouncy Castle ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1490 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1490.json" }, { "category": "self", "summary": "WID-SEC-2023-1490 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1490" }, { "category": "external", "summary": "Github Security Advisory vom 2023-06-18", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3954 vom 2023-06-29", "url": "https://access.redhat.com/errata/RHSA-2023:3954" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:2843-1 vom 2023-07-17", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-July/015507.html" }, { "category": "external", "summary": "PDFreactor 11 Hotfix Release 11.6.6", "url": "https://www.pdfreactor.com/pdfreactor-11-hotfix-release-11-6-6-now-available/" }, { "category": "external", "summary": "Debian Security Advisory DLA-3514 vom 2023-08-02", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0278 vom 2024-01-17", "url": "https://access.redhat.com/errata/RHSA-2024:0278" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5147 vom 2023-09-13", "url": "https://access.redhat.com/errata/RHSA-2023:5147" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5165 vom 2023-09-14", "url": "https://access.redhat.com/errata/RHSA-2023:5165" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5484 vom 2023-10-05", "url": "https://access.redhat.com/errata/RHSA-2023:5484" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5488 vom 2023-10-05", "url": "https://access.redhat.com/errata/RHSA-2023:5488" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5486 vom 2023-10-06", "url": "https://access.redhat.com/errata/RHSA-2023:5486" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5485 vom 2023-10-06", "url": "https://access.redhat.com/errata/RHSA-2023:5485" }, { "category": "external", "summary": "IBM Security Bulletin 7068195 vom 2023-11-07", "url": "https://www.ibm.com/support/pages/node/7068195" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7483 vom 2023-11-25", "url": "https://access.redhat.com/errata/RHSA-2023:7483" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7484 vom 2023-11-25", "url": "https://access.redhat.com/errata/RHSA-2023:7484" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7482 vom 2023-11-25", "url": "https://access.redhat.com/errata/RHSA-2023:7482" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7488 vom 2023-11-25", "url": "https://access.redhat.com/errata/RHSA-2023:7488" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7486 vom 2023-11-25", "url": "https://access.redhat.com/errata/RHSA-2023:7486" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:1353 vom 2024-03-18", "url": "https://access.redhat.com/errata/RHSA-2024:1353" }, { "category": "external", "summary": "IBM Security Bulletin", "url": "https://www.ibm.com/support/pages/node/7117232" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3527 vom 2024-05-30", "url": "https://access.redhat.com/errata/RHSA-2024:3527" } ], "source_lang": "en-US", "title": "Bouncy Castle: Schwachstelle erm\u00f6glicht Offenlegung von Informationen", "tracking": { "current_release_date": "2024-05-30T22:00:00.000+00:00", "generator": { "date": "2024-05-31T09:08:20.322+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1490", "initial_release_date": "2023-06-18T22:00:00.000+00:00", "revision_history": [ { "date": "2023-06-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-06-29T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-16T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-07-26T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates aufgenommen" }, { "date": "2023-08-02T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-09-13T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-14T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-10-05T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-11-07T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-11-26T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-17T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-03-17T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-03-19T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-30T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "14" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "IBM InfoSphere Guardium", "product": { "name": "IBM InfoSphere Guardium", "product_id": "T002366", "product_identification_helper": { "cpe": "cpe:/a:ibm:infosphere_guardium:-" } } }, { "branches": [ { "category": "product_version", "name": "11.7", "product": { "name": "IBM InfoSphere Information Server 11.7", "product_id": "444803", "product_identification_helper": { "cpe": "cpe:/a:ibm:infosphere_information_server:11.7" } } } ], "category": "product_name", "name": "InfoSphere Information Server" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c1.74", "product": { "name": "Open Source Bouncy Castle \u003c1.74", "product_id": "T028184", "product_identification_helper": { "cpe": "cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.74" } } } ], "category": "product_name", "name": "Bouncy Castle" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c11.6.6", "product": { "name": "RealObjects PDFreactor \u003c11.6.6", "product_id": "T028930", "product_identification_helper": { "cpe": "cpe:/a:realobjects:pdfreactor:11.6.6" } } } ], "category": "product_name", "name": "PDFreactor" } ], "category": "vendor", "name": "RealObjects" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Bouncy Castle. Diese ist darauf zur\u00fcckzuf\u00fchren, dass X.500 Zertifikate nicht \u00fcberpr\u00fcft werden. Dies erm\u00f6glicht eine Blind-LDAP-Injection. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "444803", "T002366", "T028930" ] }, "release_date": "2023-06-18T22:00:00Z", "title": "CVE-2023-33201" } ] }
wid-sec-w-2024-0873
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Financial Services ist eine Zusammenstellung von Anwendungen f\u00fcr den Finanzsektor und eine Technologiebasis zur Erf\u00fcllung von IT- und Gesch\u00e4ftsanforderungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0873 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0873.json" }, { "category": "self", "summary": "WID-SEC-2024-0873 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0873" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Financial Services Applications vom 2024-04-16", "url": "https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixIFLX" } ], "source_lang": "en-US", "title": "Oracle Financial Services Applications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-04-16T22:00:00.000+00:00", "generator": { "date": "2024-04-17T08:35:56.086+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0873", "initial_release_date": "2024-04-16T22:00:00.000+00:00", "revision_history": [ { "date": "2024-04-16T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "2.9.0.0.0", "product": { "name": "Oracle Financial Services Applications 2.9.0.0.0", "product_id": "T023930", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.9.0.0.0" } } }, { "category": "product_version", "name": "2.9.0.1.0", "product": { "name": "Oracle Financial Services Applications 2.9.0.1.0", "product_id": "T023931", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.9.0.1.0" } } }, { "category": "product_version", "name": "3.2.0.0.0", "product": { "name": "Oracle Financial Services Applications 3.2.0.0.0", "product_id": "T023932", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.2.0.0.0" } } }, { "category": "product_version", "name": "19.1.0.0.0", "product": { "name": "Oracle Financial Services Applications 19.1.0.0.0", "product_id": "T028693", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:19.1.0.0.0" } } }, { "category": "product_version", "name": "19.2.0.0.0", "product": { "name": "Oracle Financial Services Applications 19.2.0.0.0", "product_id": "T028694", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:19.2.0.0.0" } } }, { "category": "product_version", "name": "21.1.0.0.0", "product": { "name": "Oracle Financial Services Applications 21.1.0.0.0", "product_id": "T028695", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:21.1.0.0.0" } } }, { "category": "product_version", "name": "22.1.0.0.0", "product": { "name": "Oracle Financial Services Applications 22.1.0.0.0", "product_id": "T028696", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.1.0.0.0" } } }, { "category": "product_version", "name": "22.2.0.0.0", "product": { "name": "Oracle Financial Services Applications 22.2.0.0.0", "product_id": "T028697", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.2.0.0.0" } } }, { "category": "product_version", "name": "14.7.0.0.0", "product": { "name": "Oracle Financial Services Applications 14.7.0.0.0", "product_id": "T028702", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.0.0" } } }, { "category": "product_version", "name": "14.7.0.3.0", "product": { "name": "Oracle Financial Services Applications 14.7.0.3.0", "product_id": "T032111", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.3.0" } } }, { "category": "product_version", "name": "12.1.0.0.0", "product": { "name": "Oracle Financial Services Applications 12.1.0.0.0", "product_id": "T034159", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:12.1.0.0.0" } } }, { "category": "product_version", "name": "14.5.0.0.0", "product": { "name": "Oracle Financial Services Applications 14.5.0.0.0", "product_id": "T034160", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.5.0.0.0" } } }, { "category": "product_version", "name": "14.6.0.0.0", "product": { "name": "Oracle Financial Services Applications 14.6.0.0.0", "product_id": "T034161", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.6.0.0.0" } } }, { "category": "product_version", "name": "2.12.0.0.0", "product": { "name": "Oracle Financial Services Applications 2.12.0.0.0", "product_id": "T034162", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.12.0.0.0" } } }, { "category": "product_version", "name": "2.7.0.0.0", "product": { "name": "Oracle Financial Services Applications 2.7.0.0.0", "product_id": "T034163", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.7.0.0.0" } } }, { "category": "product_version", "name": "2.8.0.0.0", "product": { "name": "Oracle Financial Services Applications 2.8.0.0.0", "product_id": "T034164", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.8.0.0.0" } } }, { "category": "product_version", "name": "3.0.0.0.0", "product": { "name": "Oracle Financial Services Applications 3.0.0.0.0", "product_id": "T034165", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.0.0.0.0" } } }, { "category": "product_version", "name": "3.1.0.0.0", "product": { "name": "Oracle Financial Services Applications 3.1.0.0.0", "product_id": "T034166", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.1.0.0.0" } } }, { "category": "product_version", "name": "4.0.0.0", "product": { "name": "Oracle Financial Services Applications 4.0.0.0", "product_id": "T034167", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:4.0.0.0" } } }, { "category": "product_version", "name": "5.0.0.0", "product": { "name": "Oracle Financial Services Applications 5.0.0.0", "product_id": "T034168", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:5.0.0.0" } } } ], "category": "product_name", "name": "Financial Services Applications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31160", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-31160" }, { "cve": "CVE-2022-46337", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-46337" }, { "cve": "CVE-2023-2618", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-2618" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-42503", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-42503" }, { "cve": "CVE-2023-44271", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44271" }, { "cve": "CVE-2023-44483", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44483" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-44981", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44981" }, { "cve": "CVE-2023-46589", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-46589" }, { "cve": "CVE-2023-46604", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-46604" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2024-23635", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-23635" }, { "cve": "CVE-2024-26308", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028693", "T028694", "T034159", "T034165", "T034164", "T034163", "T034162", "T032111", "T034168", "T034167", "T034166", "T034161", "T023930", "T034160", "T023931", "T023932", "T028702", "T028697", "T028695", "T028696" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-26308" } ] }
wid-sec-w-2023-2675
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Financial Services ist eine Zusammenstellung von Anwendungen f\u00fcr den Finanzsektor und eine Technologiebasis zur Erf\u00fcllung von IT- und Gesch\u00e4ftsanforderungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2675 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2675.json" }, { "category": "self", "summary": "WID-SEC-2023-2675 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2675" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Financial Services Applications vom 2023-10-17", "url": "https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixIFLX" } ], "source_lang": "en-US", "title": "Oracle Financial Services Applications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-10-17T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:48:09.706+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-2675", "initial_release_date": "2023-10-17T22:00:00.000+00:00", "revision_history": [ { "date": "2023-10-17T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Financial Services Applications 2.6.2", "product": { "name": "Oracle Financial Services Applications 2.6.2", "product_id": "T018977", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.6.2" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.9.0", "product": { "name": "Oracle Financial Services Applications 2.9.0", "product_id": "T018981", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.9.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications \u003c= 14.3", "product": { "name": "Oracle Financial Services Applications \u003c= 14.3", "product_id": "T019887", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.3" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 12.3", "product": { "name": "Oracle Financial Services Applications 12.3", "product_id": "T019893", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:12.3" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 12.4", "product": { "name": "Oracle Financial Services Applications 12.4", "product_id": "T019894", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:12.4" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications \u003c= 11.8", "product": { "name": "Oracle Financial Services Applications \u003c= 11.8", "product_id": "T020696", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:11.8" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 11.10", "product": { "name": "Oracle Financial Services Applications 11.10", "product_id": "T020698", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:11.10" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 18.3", "product": { "name": "Oracle Financial Services Applications 18.3", "product_id": "T021669", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:18.3" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 19.1", "product": { "name": "Oracle Financial Services Applications 19.1", "product_id": "T021670", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:19.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 19.2", "product": { "name": "Oracle Financial Services Applications 19.2", "product_id": "T021671", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:19.2" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 21.1", "product": { "name": "Oracle Financial Services Applications 21.1", "product_id": "T021673", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:21.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.7", "product": { "name": "Oracle Financial Services Applications 2.7", "product_id": "T023927", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.7" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.12", "product": { "name": "Oracle Financial Services Applications 2.12", "product_id": "T023929", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.12" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications \u003c= 14.7", "product": { "name": "Oracle Financial Services Applications \u003c= 14.7", "product_id": "T027348", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.7" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 22.1", "product": { "name": "Oracle Financial Services Applications 22.1", "product_id": "T027349", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 22.2", "product": { "name": "Oracle Financial Services Applications 22.2", "product_id": "T027350", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.2" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.2.4", "product": { "name": "Oracle Financial Services Applications 8.1.2.4", "product_id": "T027351", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.2.4" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.2.3", "product": { "name": "Oracle Financial Services Applications 8.1.2.3", "product_id": "T027352", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.2.3" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 11.11", "product": { "name": "Oracle Financial Services Applications 11.11", "product_id": "T027366", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:11.11" } } } ], "category": "product_name", "name": "Financial Services Applications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-34981", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34981" }, { "cve": "CVE-2023-34462", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34462" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-28439", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-28439" }, { "cve": "CVE-2023-26049", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-26049" }, { "cve": "CVE-2023-24998", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-24998" }, { "cve": "CVE-2023-22946", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22946" }, { "cve": "CVE-2023-22125", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22125" }, { "cve": "CVE-2023-22124", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22124" }, { "cve": "CVE-2023-22123", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22123" }, { "cve": "CVE-2023-22122", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22122" }, { "cve": "CVE-2023-22121", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22121" }, { "cve": "CVE-2023-22119", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22119" }, { "cve": "CVE-2023-22118", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22118" }, { "cve": "CVE-2023-22117", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22117" }, { "cve": "CVE-2023-20883", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20883" }, { "cve": "CVE-2023-20873", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20873" }, { "cve": "CVE-2023-20863", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20863" }, { "cve": "CVE-2023-20862", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20862" }, { "cve": "CVE-2023-1436", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-1436" }, { "cve": "CVE-2023-1370", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-1370" }, { "cve": "CVE-2022-48285", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-48285" }, { "cve": "CVE-2022-45688", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-45688" }, { "cve": "CVE-2022-42003", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-42003" }, { "cve": "CVE-2022-41966", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-41966" }, { "cve": "CVE-2022-41881", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-41881" }, { "cve": "CVE-2022-36033", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-36033" }, { "cve": "CVE-2022-33980", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-33980" }, { "cve": "CVE-2022-3171", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-3171" }, { "cve": "CVE-2022-29577", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-29577" }, { "cve": "CVE-2022-1471", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-1471" }, { "cve": "CVE-2021-41165", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2021-41165" }, { "cve": "CVE-2021-37533", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T027351", "T027352", "T027350", "T023927", "T019894", "T018981", "T019893", "T023929", "T020698", "T021669", "T018977", "T027349", "T021673", "T027366", "T021671", "T021670" ], "last_affected": [ "T019887", "T020696", "T027348" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2021-37533" } ] }
wid-sec-w-2024-0113
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen L\u00f6sungen f\u00fcr Ver- und Entsorger.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0113 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0113.json" }, { "category": "self", "summary": "WID-SEC-2024-0113 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0113" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Utilities Applications vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixUTIL" }, { "category": "external", "summary": "Fedora Security Advisory FEDORA-2024-8EAF80107A vom 2024-03-19", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-8eaf80107a" } ], "source_lang": "en-US", "title": "Oracle Utilities Applications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-03-19T23:00:00.000+00:00", "generator": { "date": "2024-03-20T09:36:27.910+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0113", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-03-19T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Fedora aufgenommen" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Fedora Linux", "product": { "name": "Fedora Linux", "product_id": "74185", "product_identification_helper": { "cpe": "cpe:/o:fedoraproject:fedora:-" } } } ], "category": "vendor", "name": "Fedora" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c= 4.3.0.6.0", "product": { "name": "Oracle Utilities Applications \u003c= 4.3.0.6.0", "product_id": "T032149", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.3.0.6.0" } } }, { "category": "product_version", "name": "4.4.0.0.0", "product": { "name": "Oracle Utilities Applications 4.4.0.0.0", "product_id": "T032150", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.4.0.0.0" } } }, { "category": "product_version", "name": "4.4.0.2.0", "product": { "name": "Oracle Utilities Applications 4.4.0.2.0", "product_id": "T032151", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.4.0.2.0" } } }, { "category": "product_version", "name": "4.4.0.3.0", "product": { "name": "Oracle Utilities Applications 4.4.0.3.0", "product_id": "T032152", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.4.0.3.0" } } }, { "category": "product_version", "name": "2.3.0.2", "product": { "name": "Oracle Utilities Applications 2.3.0.2", "product_id": "T032153", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.3.0.2" } } }, { "category": "product_version", "name": "2.4.0.1", "product": { "name": "Oracle Utilities Applications 2.4.0.1", "product_id": "T032154", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.4.0.1" } } }, { "category": "product_version", "name": "2.5.0.1", "product": { "name": "Oracle Utilities Applications 2.5.0.1", "product_id": "T032155", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.5.0.1" } } }, { "category": "product_version", "name": "2.5.0.2", "product": { "name": "Oracle Utilities Applications 2.5.0.2", "product_id": "T032156", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.5.0.2" } } }, { "category": "product_version", "name": "2.6.0.0", "product": { "name": "Oracle Utilities Applications 2.6.0.0", "product_id": "T032157", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.6.0.0" } } }, { "category": "product_version", "name": "2.6.0.1", "product": { "name": "Oracle Utilities Applications 2.6.0.1", "product_id": "T032158", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:2.6.0.1" } } }, { "category": "product_version", "name": "4.5.0.0.0", "product": { "name": "Oracle Utilities Applications 4.5.0.0.0", "product_id": "T032160", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.5.0.0.0" } } }, { "category": "product_version", "name": "4.5.0.1.1", "product": { "name": "Oracle Utilities Applications 4.5.0.1.1", "product_id": "T032161", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.5.0.1.1" } } }, { "category": "product_version", "name": "4.5.0.1.3", "product": { "name": "Oracle Utilities Applications 4.5.0.1.3", "product_id": "T032162", "product_identification_helper": { "cpe": "cpe:/a:oracle:utilities:4.5.0.1.3" } } } ], "category": "product_name", "name": "Utilities Applications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-42503", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-42503" }, { "cve": "CVE-2023-34462", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34462" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2022-40896", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-40896" }, { "cve": "CVE-2021-29425", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-29425" }, { "cve": "CVE-2020-7760", "notes": [ { "category": "description", "text": "In Oracle Utilities Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032157", "T032158", "T032151", "T032162", "T032152", "T032160", "T032150", "T032161", "T032155", "T032156", "74185", "T032153", "T032154" ], "last_affected": [ "T032149" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2020-7760" } ] }
wid-sec-w-2024-0899
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Fusion Middleware b\u00fcndelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0899 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0899.json" }, { "category": "self", "summary": "WID-SEC-2024-0899 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0899" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Fusion Middleware vom 2024-04-16", "url": "https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixFMW" } ], "source_lang": "en-US", "title": "Oracle Fusion Middleware: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-04-16T22:00:00.000+00:00", "generator": { "date": "2024-04-17T10:37:23.833+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0899", "initial_release_date": "2024-04-16T22:00:00.000+00:00", "revision_history": [ { "date": "2024-04-16T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "12.2.1.3.0", "product": { "name": "Oracle Fusion Middleware 12.2.1.3.0", "product_id": "618028", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:12.2.1.3.0" } } }, { "category": "product_version", "name": "12.2.1.4.0", "product": { "name": "Oracle Fusion Middleware 12.2.1.4.0", "product_id": "751674", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:12.2.1.4.0" } } }, { "category": "product_version", "name": "14.1.1.0.0", "product": { "name": "Oracle Fusion Middleware 14.1.1.0.0", "product_id": "829576", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:14.1.1.0.0" } } }, { "category": "product_version", "name": "8.5.6", "product": { "name": "Oracle Fusion Middleware 8.5.6", "product_id": "T024993", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:8.5.6" } } }, { "category": "product_version", "name": "8.5.7", "product": { "name": "Oracle Fusion Middleware 8.5.7", "product_id": "T034057", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:8.5.7" } } } ], "category": "product_name", "name": "Fusion Middleware" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-0231", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2019-0231" }, { "cve": "CVE-2019-10172", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2019-10172" }, { "cve": "CVE-2019-13990", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2019-13990" }, { "cve": "CVE-2021-23369", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2021-23369" }, { "cve": "CVE-2022-1471", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-1471" }, { "cve": "CVE-2022-24329", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-24329" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-34169", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-34169" }, { "cve": "CVE-2022-34381", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-34381" }, { "cve": "CVE-2022-42003", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-42003" }, { "cve": "CVE-2022-45378", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-45378" }, { "cve": "CVE-2022-46337", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-46337" }, { "cve": "CVE-2022-48579", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-48579" }, { "cve": "CVE-2023-24021", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-24021" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-31122", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-31122" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-35116", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-35116" }, { "cve": "CVE-2023-35887", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-35887" }, { "cve": "CVE-2023-3635", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-3635" }, { "cve": "CVE-2023-37536", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-37536" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-46218", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-46218" }, { "cve": "CVE-2023-46589", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-46589" }, { "cve": "CVE-2023-48795", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-48795" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-52428", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-52428" }, { "cve": "CVE-2024-1597", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-1597" }, { "cve": "CVE-2024-20991", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-20991" }, { "cve": "CVE-2024-20992", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-20992" }, { "cve": "CVE-2024-21006", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21006" }, { "cve": "CVE-2024-21007", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21007" }, { "cve": "CVE-2024-21117", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21117" }, { "cve": "CVE-2024-21118", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21118" }, { "cve": "CVE-2024-21119", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21119" }, { "cve": "CVE-2024-21120", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21120" }, { "cve": "CVE-2024-23635", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-23635" }, { "cve": "CVE-2024-26308", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "618028", "751674", "T034057", "829576" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-26308" } ] }
wid-sec-w-2024-0869
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Communications umfasst branchenspezifische L\u00f6sungen f\u00fcr die Telekommunikationsbranche.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0869 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0869.json" }, { "category": "self", "summary": "WID-SEC-2024-0869 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0869" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Communications vom 2024-04-16", "url": "https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixCGBU" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:1878 vom 2024-04-18", "url": "https://access.redhat.com/errata/RHSA-2024:1878" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-01 vom 2024-05-04", "url": "https://security.gentoo.org/glsa/202405-01" } ], "source_lang": "en-US", "title": "Oracle Communications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-05T22:00:00.000+00:00", "generator": { "date": "2024-05-06T08:33:02.513+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0869", "initial_release_date": "2024-04-16T22:00:00.000+00:00", "revision_history": [ { "date": "2024-04-16T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-04-17T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-05T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "5", "product": { "name": "Oracle Communications 5.0", "product_id": "T021645", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.0" } } }, { "category": "product_version", "name": "22.4.0", "product": { "name": "Oracle Communications 22.4.0", "product_id": "T024981", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:22.4.0" } } }, { "category": "product_version", "name": "23.1.0", "product": { "name": "Oracle Communications 23.1.0", "product_id": "T027326", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.0" } } }, { "category": "product_version", "name": "23.2.0", "product": { "name": "Oracle Communications 23.2.0", "product_id": "T028682", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.0" } } }, { "category": "product_version", "name": "5.1", "product": { "name": "Oracle Communications 5.1", "product_id": "T028684", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.1" } } }, { "category": "product_version", "name": "23.2.2", "product": { "name": "Oracle Communications 23.2.2", "product_id": "T030583", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.2" } } }, { "category": "product_version", "name": "23.3.0", "product": { "name": "Oracle Communications 23.3.0", "product_id": "T030586", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.0" } } }, { "category": "product_version", "name": "9.0.0.0", "product": { "name": "Oracle Communications 9.0.0.0", "product_id": "T030589", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.0.0" } } }, { "category": "product_version_range", "name": "\u003c=7.2.1.0.0", "product": { "name": "Oracle Communications \u003c=7.2.1.0.0", "product_id": "T030593", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.2.1.0.0" } } }, { "category": "product_version_range", "name": "\u003c=9.0.2", "product": { "name": "Oracle Communications \u003c=9.0.2", "product_id": "T030595", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.2" } } }, { "category": "product_version", "name": "23.3.1", "product": { "name": "Oracle Communications 23.3.1", "product_id": "T032088", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.1" } } }, { "category": "product_version", "name": "23.4.0", "product": { "name": "Oracle Communications 23.4.0", "product_id": "T032091", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.4.0" } } }, { "category": "product_version", "name": "23.4.1", "product": { "name": "Oracle Communications 23.4.1", "product_id": "T034143", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.4.1" } } }, { "category": "product_version_range", "name": "\u003c=23.4.2", "product": { "name": "Oracle Communications \u003c=23.4.2", "product_id": "T034144", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.4.2" } } }, { "category": "product_version", "name": "24.1.0", "product": { "name": "Oracle Communications 24.1.0", "product_id": "T034145", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:24.1.0" } } }, { "category": "product_version", "name": "5.2", "product": { "name": "Oracle Communications 5.2", "product_id": "T034146", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.2" } } }, { "category": "product_version", "name": "24.1.0.0.0", "product": { "name": "Oracle Communications 24.1.0.0.0", "product_id": "T034147", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:24.1.0.0.0" } } }, { "category": "product_version", "name": "23.3.2", "product": { "name": "Oracle Communications 23.3.2", "product_id": "T034148", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.2" } } }, { "category": "product_version", "name": "14.0.0.0.0", "product": { "name": "Oracle Communications 14.0.0.0.0", "product_id": "T034149", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:14.0.0.0.0" } } }, { "category": "product_version", "name": "9.1.1.7.0", "product": { "name": "Oracle Communications 9.1.1.7.0", "product_id": "T034150", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.1.1.7.0" } } } ], "category": "product_name", "name": "Communications" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-40152", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-40152" }, { "cve": "CVE-2022-40896", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-40896" }, { "cve": "CVE-2022-45688", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2022-45688" }, { "cve": "CVE-2023-2283", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-2283" }, { "cve": "CVE-2023-31122", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-31122" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-34053", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-34053" }, { "cve": "CVE-2023-34055", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-34055" }, { "cve": "CVE-2023-4016", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-4016" }, { "cve": "CVE-2023-41056", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-41056" }, { "cve": "CVE-2023-43496", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-43496" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45142", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-45142" }, { "cve": "CVE-2023-4641", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-4641" }, { "cve": "CVE-2023-46589", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-46589" }, { "cve": "CVE-2023-47100", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-47100" }, { "cve": "CVE-2023-4863", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-4863" }, { "cve": "CVE-2023-48795", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-48795" }, { "cve": "CVE-2023-49083", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-49083" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-51074", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-51074" }, { "cve": "CVE-2023-51257", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-51257" }, { "cve": "CVE-2023-51775", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-51775" }, { "cve": "CVE-2023-5341", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-5341" }, { "cve": "CVE-2023-5363", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-5363" }, { "cve": "CVE-2023-6507", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2023-6507" }, { "cve": "CVE-2024-1635", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-1635" }, { "cve": "CVE-2024-21626", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-21626" }, { "cve": "CVE-2024-22201", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-22201" }, { "cve": "CVE-2024-22233", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-22233" }, { "cve": "CVE-2024-22257", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-22257" }, { "cve": "CVE-2024-22259", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-22259" }, { "cve": "CVE-2024-25062", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-25062" }, { "cve": "CVE-2024-26130", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-26130" }, { "cve": "CVE-2024-26308", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T034149", "T030586", "T034148", "T030589", "67646", "T034143", "T012167", "T034147", "T034146", "T030583", "T034145", "T032088", "T034150", "T021645", "T032091", "T027326", "T024981", "T028684" ], "last_affected": [ "T030595", "T030593", "T034144" ] }, "release_date": "2024-04-16T22:00:00Z", "title": "CVE-2024-26308" } ] }
wid-sec-w-2024-0107
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Communications Applications umfasst eine Sammlung von Werkzeugen zur Verwaltung von Messaging-, Kommunikationsdiensten und -ressourcen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0107 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0107.json" }, { "category": "self", "summary": "WID-SEC-2024-0107 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0107" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Communications Applications vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixCAGBU" } ], "source_lang": "en-US", "title": "Oracle Communications Applications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-16T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:56:42.860+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0107", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Communications Applications 7.4.0", "product": { "name": "Oracle Communications Applications 7.4.0", "product_id": "T018938", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4.1", "product": { "name": "Oracle Communications Applications 7.4.1", "product_id": "T018939", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.1" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4.2", "product": { "name": "Oracle Communications Applications 7.4.2", "product_id": "T018940", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.2" } } }, { "category": "product_name", "name": "Oracle Communications Applications 6.0.1.0.0", "product": { "name": "Oracle Communications Applications 6.0.1.0.0", "product_id": "T021634", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:6.0.1.0.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.5.0", "product": { "name": "Oracle Communications Applications 7.5.0", "product_id": "T021639", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.5.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4", "product": { "name": "Oracle Communications Applications 7.4", "product_id": "T022811", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 12.0.6.0.0", "product": { "name": "Oracle Communications Applications \u003c= 12.0.6.0.0", "product_id": "T027325", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:12.0.6.0.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 12.0.0.8.0", "product": { "name": "Oracle Communications Applications \u003c= 12.0.0.8.0", "product_id": "T028669", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:12.0.0.8.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 3.0.3.2", "product": { "name": "Oracle Communications Applications 3.0.3.2", "product_id": "T028670", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:3.0.3.2" } } }, { "category": "product_name", "name": "Oracle Communications Applications 10.0.1.7.0", "product": { "name": "Oracle Communications Applications 10.0.1.7.0", "product_id": "T028674", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:10.0.1.7.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4.0.7.0", "product": { "name": "Oracle Communications Applications 7.4.0.7.0", "product_id": "T028676", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.0.7.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4.1.5.0", "product": { "name": "Oracle Communications Applications 7.4.1.5.0", "product_id": "T028677", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.1.5.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 7.4.2.8.0", "product": { "name": "Oracle Communications Applications 7.4.2.8.0", "product_id": "T028678", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:7.4.2.8.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 6.3.1.0.0", "product": { "name": "Oracle Communications Applications 6.3.1.0.0", "product_id": "T030578", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:6.3.1.0.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 12.0.0.8", "product": { "name": "Oracle Communications Applications \u003c= 12.0.0.8", "product_id": "T030579", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:12.0.0.8" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 6.0.3", "product": { "name": "Oracle Communications Applications \u003c= 6.0.3", "product_id": "T030581", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:6.0.3" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 12.0.0.7", "product": { "name": "Oracle Communications Applications \u003c= 12.0.0.7", "product_id": "T032083", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:12.0.0.7" } } }, { "category": "product_name", "name": "Oracle Communications Applications 15.0.0.0.0", "product": { "name": "Oracle Communications Applications 15.0.0.0.0", "product_id": "T032084", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:15.0.0.0.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications 3.0.3.3", "product": { "name": "Oracle Communications Applications 3.0.3.3", "product_id": "T032085", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:3.0.3.3" } } }, { "category": "product_name", "name": "Oracle Communications Applications 8.1.0.24.0", "product": { "name": "Oracle Communications Applications 8.1.0.24.0", "product_id": "T032086", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:8.1.0.24.0" } } }, { "category": "product_name", "name": "Oracle Communications Applications \u003c= 5.5.19", "product": { "name": "Oracle Communications Applications \u003c= 5.5.19", "product_id": "T032087", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications_applications:5.5.19" } } } ], "category": "product_name", "name": "Communications Applications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-45648", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-45648" }, { "cve": "CVE-2023-44981", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44981" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-44483", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44483" }, { "cve": "CVE-2023-42794", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-42794" }, { "cve": "CVE-2023-42503", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-42503" }, { "cve": "CVE-2023-37536", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-37536" }, { "cve": "CVE-2023-34981", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34981" }, { "cve": "CVE-2023-34034", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34034" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-31122", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-31122" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-28823", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-28823" }, { "cve": "CVE-2023-25194", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-25194" }, { "cve": "CVE-2023-20883", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-20883" }, { "cve": "CVE-2022-45868", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-45868" }, { "cve": "CVE-2022-42920", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-42920" }, { "cve": "CVE-2022-36944", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-36944" }, { "cve": "CVE-2022-31160", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-31160" }, { "cve": "CVE-2022-31147", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-31147" }, { "cve": "CVE-2022-1471", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-1471" }, { "cve": "CVE-2021-4104", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-4104" }, { "cve": "CVE-2021-37533", "notes": [ { "category": "description", "text": "In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028670", "T030578", "T032085", "T032086", "T021639", "T032084", "T022811", "T018940", "T021634", "T028677", "T018938", "T028678", "T018939", "T028676", "T028674" ], "last_affected": [ "T030579", "T028669", "T032083", "T027325", "T030581", "T032087" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-37533" } ] }
wid-sec-w-2023-2679
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Communications umfasst branchenspezifische L\u00f6sungen f\u00fcr die Telekommunikationsbranche.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2679 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2679.json" }, { "category": "self", "summary": "WID-SEC-2023-2679 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2679" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Communications vom 2023-10-17", "url": "https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixCGBU" } ], "source_lang": "en-US", "title": "Oracle Communications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-10-17T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:48:12.918+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-2679", "initial_release_date": "2023-10-17T22:00:00.000+00:00", "revision_history": [ { "date": "2023-10-17T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Communications 3.3", "product": { "name": "Oracle Communications 3.3", "product_id": "T020687", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:3.3" } } }, { "category": "product_name", "name": "Oracle Communications 5.0", "product": { "name": "Oracle Communications 5.0", "product_id": "T021645", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.0" } } }, { "category": "product_name", "name": "Oracle Communications 8.6.0.0", "product": { "name": "Oracle Communications 8.6.0.0", "product_id": "T024970", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.6.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.0", "product": { "name": "Oracle Communications 23.1.0", "product_id": "T027326", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.1", "product": { "name": "Oracle Communications 23.1.1", "product_id": "T027329", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.1" } } }, { "category": "product_name", "name": "Oracle Communications 4.0", "product": { "name": "Oracle Communications 4.0", "product_id": "T027337", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:4.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.2", "product": { "name": "Oracle Communications 23.1.2", "product_id": "T028681", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.2" } } }, { "category": "product_name", "name": "Oracle Communications 23.2.0", "product": { "name": "Oracle Communications 23.2.0", "product_id": "T028682", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.0" } } }, { "category": "product_name", "name": "Oracle Communications 5.1", "product": { "name": "Oracle Communications 5.1", "product_id": "T028684", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.1" } } }, { "category": "product_name", "name": "Oracle Communications 9.1.1.5.0", "product": { "name": "Oracle Communications 9.1.1.5.0", "product_id": "T028685", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.1.1.5.0" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 23.1.7", "product": { "name": "Oracle Communications \u003c= 23.1.7", "product_id": "T030582", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.7" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 23.2.2", "product": { "name": "Oracle Communications \u003c= 23.2.2", "product_id": "T030583", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.2" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.3", "product": { "name": "Oracle Communications 23.1.3", "product_id": "T030584", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.3" } } }, { "category": "product_name", "name": "Oracle Communications 23.2.1", "product": { "name": "Oracle Communications 23.2.1", "product_id": "T030585", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.1" } } }, { "category": "product_name", "name": "Oracle Communications 23.3.0", "product": { "name": "Oracle Communications 23.3.0", "product_id": "T030586", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.0" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 23.1.8", "product": { "name": "Oracle Communications \u003c= 23.1.8", "product_id": "T030587", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.8" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 23.2.4", "product": { "name": "Oracle Communications \u003c= 23.2.4", "product_id": "T030588", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.4" } } }, { "category": "product_name", "name": "Oracle Communications 9.0.0.0", "product": { "name": "Oracle Communications 9.0.0.0", "product_id": "T030589", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 12.6.0.0", "product": { "name": "Oracle Communications 12.6.0.0", "product_id": "T030590", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:12.6.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.0.0", "product": { "name": "Oracle Communications 23.1.0.0", "product_id": "T030591", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 7.2.0.0.0", "product": { "name": "Oracle Communications 7.2.0.0.0", "product_id": "T030592", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.2.0.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 7.2.1.0.0", "product": { "name": "Oracle Communications 7.2.1.0.0", "product_id": "T030593", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.2.1.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 9.1.1.6.0", "product": { "name": "Oracle Communications 9.1.1.6.0", "product_id": "T030594", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.1.1.6.0" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 9.0.2", "product": { "name": "Oracle Communications \u003c= 9.0.2", "product_id": "T030595", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.2" } } }, { "category": "product_name", "name": "Oracle Communications 4.1", "product": { "name": "Oracle Communications 4.1", "product_id": "T030596", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:4.1" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 9.2", "product": { "name": "Oracle Communications \u003c= 9.2", "product_id": "T030597", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.2" } } } ], "category": "product_name", "name": "Communications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-41080", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-41080" }, { "cve": "CVE-2023-4039", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-4039" }, { "cve": "CVE-2023-40167", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-40167" }, { "cve": "CVE-2023-38408", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-38408" }, { "cve": "CVE-2023-3824", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-3824" }, { "cve": "CVE-2023-3635", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-3635" }, { "cve": "CVE-2023-35788", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-35788" }, { "cve": "CVE-2023-34981", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34981" }, { "cve": "CVE-2023-34462", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34462" }, { "cve": "CVE-2023-34396", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34396" }, { "cve": "CVE-2023-34034", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-34034" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-30861", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-30861" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-29491", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-29491" }, { "cve": "CVE-2023-28484", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-28484" }, { "cve": "CVE-2023-26604", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-26604" }, { "cve": "CVE-2023-26049", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-26049" }, { "cve": "CVE-2023-26048", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-26048" }, { "cve": "CVE-2023-2603", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-2603" }, { "cve": "CVE-2023-23931", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-23931" }, { "cve": "CVE-2023-2283", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-2283" }, { "cve": "CVE-2023-22083", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-22083" }, { "cve": "CVE-2023-20883", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20883" }, { "cve": "CVE-2023-20863", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-20863" }, { "cve": "CVE-2023-0361", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2023-0361" }, { "cve": "CVE-2022-4899", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-4899" }, { "cve": "CVE-2022-45688", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-45688" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-4492", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-4492" }, { "cve": "CVE-2022-42920", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-42920" }, { "cve": "CVE-2022-40982", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-40982" }, { "cve": "CVE-2022-36944", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-36944" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-24834", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-24834" }, { "cve": "CVE-2022-24329", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2022-24329" }, { "cve": "CVE-2021-41945", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2021-41945" }, { "cve": "CVE-2021-37533", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2021-37533" }, { "cve": "CVE-2020-7760", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030596", "T030584", "T028681", "T030586", "T030589", "T030590", "T030592", "T030591", "T030594", "T030593", "T020687", "T021645", "T027329", "T027326", "T027337", "T024970", "T028684", "T028685" ], "last_affected": [ "T030595", "T030587", "T030597", "T030588", "T030583", "T030582" ] }, "release_date": "2023-10-17T22:00:00Z", "title": "CVE-2020-7760" } ] }
wid-sec-w-2023-3070
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "JBoss A-MQ ist eine Messaging-Plattform.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3070 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3070.json" }, { "category": "self", "summary": "WID-SEC-2023-3070 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3070" }, { "category": "external", "summary": "Atlassian Security Bulletin December 12 2023 vom 2023-12-12", "url": "https://confluence.atlassian.com/security/security-bulletin-december-12-2023-1319249520.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0903 vom 2024-02-20", "url": "https://access.redhat.com/errata/RHSA-2024:0903" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0705 vom 2024-02-06", "url": "https://access.redhat.com/errata/RHSA-2024:0705" }, { "category": "external", "summary": "RedHat Security Advisory vom 2023-12-06", "url": "https://access.redhat.com/errata/RHSA-2023:7678" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7697 vom 2023-12-07", "url": "https://access.redhat.com/errata/RHSA-2023:7697" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2945 vom 2024-05-21", "url": "https://access.redhat.com/errata/RHSA-2024:2945" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3354 vom 2024-05-24", "url": "https://access.redhat.com/errata/RHSA-2024:3354" } ], "source_lang": "en-US", "title": "Red Hat JBoss A-MQ: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-23T22:00:00.000+00:00", "generator": { "date": "2024-05-24T08:08:42.043+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-3070", "initial_release_date": "2023-12-06T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-06T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-12-07T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-12-12T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates aufgenommen" }, { "date": "2024-02-06T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-02-20T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-21T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-23T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "7" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c9.2.7", "product": { "name": "Atlassian Bamboo \u003c9.2.7", "product_id": "1529586", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bamboo:9.2.7" } } }, { "category": "product_version_range", "name": "\u003c9.3.5", "product": { "name": "Atlassian Bamboo \u003c9.3.5", "product_id": "T031324", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bamboo:9.3.5" } } } ], "category": "product_name", "name": "Bamboo" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.21.18", "product": { "name": "Atlassian Bitbucket \u003c7.21.18", "product_id": "T031325", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:7.21.18" } } }, { "category": "product_version_range", "name": "\u003c8.9.7", "product": { "name": "Atlassian Bitbucket \u003c8.9.7", "product_id": "T031614", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:8.9.7" } } }, { "category": "product_version_range", "name": "\u003c8.11.6", "product": { "name": "Atlassian Bitbucket \u003c8.11.6", "product_id": "T031615", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:8.11.6" } } }, { "category": "product_version_range", "name": "\u003c8.12.4", "product": { "name": "Atlassian Bitbucket \u003c8.12.4", "product_id": "T031616", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:8.12.4" } } }, { "category": "product_version_range", "name": "\u003c8.13.3", "product": { "name": "Atlassian Bitbucket \u003c8.13.3", "product_id": "T031617", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:8.13.3" } } }, { "category": "product_version_range", "name": "\u003c8.14.2", "product": { "name": "Atlassian Bitbucket \u003c8.14.2", "product_id": "T031618", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bitbucket:8.14.2" } } } ], "category": "product_name", "name": "Bitbucket" }, { "branches": [ { "category": "product_version_range", "name": "\u003c8.3.4", "product": { "name": "Atlassian Confluence \u003c8.3.4", "product_id": "T030846", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:8.3.4" } } }, { "category": "product_version_range", "name": "\u003c7.19.17", "product": { "name": "Atlassian Confluence \u003c7.19.17", "product_id": "T031609", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:7.19.17" } } }, { "category": "product_version_range", "name": "\u003c8.4.5", "product": { "name": "Atlassian Confluence \u003c8.4.5", "product_id": "T031610", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:8.4.5" } } }, { "category": "product_version_range", "name": "\u003c8.5.4", "product": { "name": "Atlassian Confluence \u003c8.5.4", "product_id": "T031611", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:8.5.4" } } }, { "category": "product_version_range", "name": "\u003c8.6.2", "product": { "name": "Atlassian Confluence \u003c8.6.2", "product_id": "T031612", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:8.6.2" } } }, { "category": "product_version_range", "name": "\u003c8.7.1", "product": { "name": "Atlassian Confluence \u003c8.7.1", "product_id": "T031613", "product_identification_helper": { "cpe": "cpe:/a:atlassian:confluence:8.7.1" } } } ], "category": "product_name", "name": "Confluence" }, { "branches": [ { "category": "product_version_range", "name": "\u003c9.4.13", "product": { "name": "Atlassian Jira Software \u003c9.4.13", "product_id": "T031606", "product_identification_helper": { "cpe": "cpe:/a:atlassian:jira_software:9.4.13" } } }, { "category": "product_version_range", "name": "Service Management \u003c4.20.28", "product": { "name": "Atlassian Jira Software Service Management \u003c4.20.28", "product_id": "T031607", "product_identification_helper": { "cpe": "cpe:/a:atlassian:jira_software:service_management__4.20.28" } } }, { "category": "product_version_range", "name": "Service Management \u003c5.4.12", "product": { "name": "Atlassian Jira Software Service Management \u003c5.4.12", "product_id": "T031608", "product_identification_helper": { "cpe": "cpe:/a:atlassian:jira_software:service_management__5.4.12" } } } ], "category": "product_name", "name": "Jira Software" } ], "category": "vendor", "name": "Atlassian" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c2.6.0 Streams", "product": { "name": "Red Hat JBoss A-MQ \u003c2.6.0 Streams", "product_id": "T031506", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_amq:2.6.0_streams" } } }, { "category": "product_version", "name": "Clients 3", "product": { "name": "Red Hat JBoss A-MQ Clients 3", "product_id": "T031509", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_amq:clients_3" } } }, { "category": "product_version_range", "name": "Broker \u003c7.12.0", "product": { "name": "Red Hat JBoss A-MQ Broker \u003c7.12.0", "product_id": "T034934", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_amq:broker__7.12.0" } } } ], "category": "product_name", "name": "JBoss A-MQ" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-46751", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2022-46751" }, { "cve": "CVE-2023-20873", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-20873" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-31582", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-31582" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-40167", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-40167" }, { "cve": "CVE-2023-41080", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-41080" }, { "cve": "CVE-2023-42445", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-42445" }, { "cve": "CVE-2023-44387", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-44387" }, { "cve": "CVE-2023-44981", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-44981" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Red Hat JBoss A-MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T031324", "T031610", "T031612", "67646", "T031325", "T031611", "T031614", "T034934", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031509", "T031608" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-5072" } ] }
wid-sec-w-2024-0106
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Communications umfasst branchenspezifische L\u00f6sungen f\u00fcr die Telekommunikationsbranche.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0106 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0106.json" }, { "category": "self", "summary": "WID-SEC-2024-0106 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0106" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Communications vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixCGBU" } ], "source_lang": "en-US", "title": "Oracle Communications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-16T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:56:41.972+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0106", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Communications 5.0", "product": { "name": "Oracle Communications 5.0", "product_id": "T021645", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.0" } } }, { "category": "product_name", "name": "Oracle Communications 8.6.0.0", "product": { "name": "Oracle Communications 8.6.0.0", "product_id": "T024970", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.6.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.0", "product": { "name": "Oracle Communications 23.1.0", "product_id": "T027326", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.0" } } }, { "category": "product_name", "name": "Oracle Communications 12.6.1.0.0", "product": { "name": "Oracle Communications 12.6.1.0.0", "product_id": "T027338", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:12.6.1.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.2.0", "product": { "name": "Oracle Communications 23.2.0", "product_id": "T028682", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.0" } } }, { "category": "product_name", "name": "Oracle Communications 5.1", "product": { "name": "Oracle Communications 5.1", "product_id": "T028684", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:5.1" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.3", "product": { "name": "Oracle Communications 23.1.3", "product_id": "T030584", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.3" } } }, { "category": "product_name", "name": "Oracle Communications 23.2.1", "product": { "name": "Oracle Communications 23.2.1", "product_id": "T030585", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.1" } } }, { "category": "product_name", "name": "Oracle Communications 23.3.0", "product": { "name": "Oracle Communications 23.3.0", "product_id": "T030586", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.0" } } }, { "category": "product_name", "name": "Oracle Communications 9.0.0.0", "product": { "name": "Oracle Communications 9.0.0.0", "product_id": "T030589", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.3.1", "product": { "name": "Oracle Communications 23.3.1", "product_id": "T032088", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.1" } } }, { "category": "product_name", "name": "Oracle Communications \u003c= 9.0.2.0.1", "product": { "name": "Oracle Communications \u003c= 9.0.2.0.1", "product_id": "T032089", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:9.0.2.0.1" } } }, { "category": "product_name", "name": "Oracle Communications 15.0.0.0.0", "product": { "name": "Oracle Communications 15.0.0.0.0", "product_id": "T032090", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.0.0.0.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.4.0", "product": { "name": "Oracle Communications 23.4.0", "product_id": "T032091", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.4.0" } } }, { "category": "product_name", "name": "Oracle Communications 23.1.4", "product": { "name": "Oracle Communications 23.1.4", "product_id": "T032092", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.1.4" } } }, { "category": "product_name", "name": "Oracle Communications 23.2.0.0.2", "product": { "name": "Oracle Communications 23.2.0.0.2", "product_id": "T032093", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.2.0.0.2" } } }, { "category": "product_name", "name": "Oracle Communications 23.3.0.0.0", "product": { "name": "Oracle Communications 23.3.0.0.0", "product_id": "T032094", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:23.3.0.0.0" } } } ], "category": "product_name", "name": "Communications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-50164", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-50164" }, { "cve": "CVE-2023-4911", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-4911" }, { "cve": "CVE-2023-46604", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-46604" }, { "cve": "CVE-2023-46589", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-46589" }, { "cve": "CVE-2023-45648", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-45648" }, { "cve": "CVE-2023-45145", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-45145" }, { "cve": "CVE-2023-44981", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44981" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-44483", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44483" }, { "cve": "CVE-2023-43496", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-43496" }, { "cve": "CVE-2023-41053", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-41053" }, { "cve": "CVE-2023-40167", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-40167" }, { "cve": "CVE-2023-38325", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-38325" }, { "cve": "CVE-2023-37536", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-37536" }, { "cve": "CVE-2023-36478", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-36478" }, { "cve": "CVE-2023-34055", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34055" }, { "cve": "CVE-2023-34053", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34053" }, { "cve": "CVE-2023-34034", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34034" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-31582", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-31582" }, { "cve": "CVE-2023-31486", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-31486" }, { "cve": "CVE-2023-30861", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-30861" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-2283", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2283" }, { "cve": "CVE-2023-22102", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-22102" }, { "cve": "CVE-2023-1108", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-1108" }, { "cve": "CVE-2022-48174", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-48174" }, { "cve": "CVE-2022-46751", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-46751" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Oracle Communications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T028682", "T030585", "T030584", "T030586", "T030589", "T032094", "T032088", "T032092", "T032093", "T032090", "T021645", "T032091", "T027326", "T024970", "T027338", "T028684" ], "last_affected": [ "T032089" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-46848" } ] }
wid-sec-w-2024-0124
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Financial Services ist eine Zusammenstellung von Anwendungen f\u00fcr den Finanzsektor und eine Technologiebasis zur Erf\u00fcllung von IT- und Gesch\u00e4ftsanforderungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0124 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0124.json" }, { "category": "self", "summary": "WID-SEC-2024-0124 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0124" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Financial Services Applications vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixIFLX" } ], "source_lang": "en-US", "title": "Oracle Financial Services Applications: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-16T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:56:56.463+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0124", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Financial Services Applications 2.7.1", "product": { "name": "Oracle Financial Services Applications 2.7.1", "product_id": "T018979", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.7.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.8.0", "product": { "name": "Oracle Financial Services Applications 2.8.0", "product_id": "T018980", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.8.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.9.0", "product": { "name": "Oracle Financial Services Applications 2.9.0", "product_id": "T018981", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.9.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.0", "product": { "name": "Oracle Financial Services Applications 8.1.0", "product_id": "T018983", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.0.9", "product": { "name": "Oracle Financial Services Applications 8.0.9", "product_id": "T019890", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.0.9" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.1", "product": { "name": "Oracle Financial Services Applications 8.1.1", "product_id": "T019891", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.0.7", "product": { "name": "Oracle Financial Services Applications 8.0.7", "product_id": "T021676", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.0.7" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.0.8", "product": { "name": "Oracle Financial Services Applications 8.0.8", "product_id": "T021677", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.0.8" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.1.1", "product": { "name": "Oracle Financial Services Applications 8.1.1.1", "product_id": "T022835", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.1.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.0.8.1", "product": { "name": "Oracle Financial Services Applications 8.0.8.1", "product_id": "T022844", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.0.8.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.0.8.2", "product": { "name": "Oracle Financial Services Applications 8.0.8.2", "product_id": "T024990", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.0.8.2" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 2.9.1", "product": { "name": "Oracle Financial Services Applications 2.9.1", "product_id": "T027359", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:2.9.1" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.2", "product": { "name": "Oracle Financial Services Applications 8.1.2", "product_id": "T028705", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.2" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.2.5", "product": { "name": "Oracle Financial Services Applications 8.1.2.5", "product_id": "T028706", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.2.5" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications \u003c= 14.7.0", "product": { "name": "Oracle Financial Services Applications \u003c= 14.7.0", "product_id": "T028707", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 22.1.0", "product": { "name": "Oracle Financial Services Applications 22.1.0", "product_id": "T032101", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.1.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 22.2.0", "product": { "name": "Oracle Financial Services Applications 22.2.0", "product_id": "T032102", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:22.2.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 21.1.0", "product": { "name": "Oracle Financial Services Applications 21.1.0", "product_id": "T032103", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:21.1.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 8.1.2.6", "product": { "name": "Oracle Financial Services Applications 8.1.2.6", "product_id": "T032104", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:8.1.2.6" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 19.1.0", "product": { "name": "Oracle Financial Services Applications 19.1.0", "product_id": "T032105", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:19.1.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 5.0.0", "product": { "name": "Oracle Financial Services Applications 5.0.0", "product_id": "T032106", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:5.0.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 5.1.0", "product": { "name": "Oracle Financial Services Applications 5.1.0", "product_id": "T032107", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:5.1.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications \u003c= 3.2.0", "product": { "name": "Oracle Financial Services Applications \u003c= 3.2.0", "product_id": "T032108", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.2.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 4.0.0", "product": { "name": "Oracle Financial Services Applications 4.0.0", "product_id": "T032109", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:4.0.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 6.0.0", "product": { "name": "Oracle Financial Services Applications 6.0.0", "product_id": "T032110", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:6.0.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 14.7.0.3.0", "product": { "name": "Oracle Financial Services Applications 14.7.0.3.0", "product_id": "T032111", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.3.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 3.0.0", "product": { "name": "Oracle Financial Services Applications 3.0.0", "product_id": "T032112", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.0.0" } } }, { "category": "product_name", "name": "Oracle Financial Services Applications 3.1.0", "product": { "name": "Oracle Financial Services Applications 3.1.0", "product_id": "T032113", "product_identification_helper": { "cpe": "cpe:/a:oracle:financial_services_applications:3.1.0" } } } ], "category": "product_name", "name": "Financial Services Applications" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-46604", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-46604" }, { "cve": "CVE-2023-44483", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44483" }, { "cve": "CVE-2023-42503", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-42503" }, { "cve": "CVE-2023-34034", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-34034" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-2618", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2618" }, { "cve": "CVE-2023-24998", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-24998" }, { "cve": "CVE-2023-21901", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-21901" }, { "cve": "CVE-2023-1436", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-1436" }, { "cve": "CVE-2023-1370", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-1370" }, { "cve": "CVE-2022-44729", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-44729" }, { "cve": "CVE-2022-42920", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-42920" }, { "cve": "CVE-2022-42003", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-42003" }, { "cve": "CVE-2022-36944", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-36944" }, { "cve": "CVE-2022-36033", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-36033" }, { "cve": "CVE-2022-34169", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-34169" }, { "cve": "CVE-2022-31692", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-31692" }, { "cve": "CVE-2022-31160", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-31160" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-22979", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-22979" }, { "cve": "CVE-2022-22969", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-22969" }, { "cve": "CVE-2020-5410", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2020-5410" }, { "cve": "CVE-2020-15250", "notes": [ { "category": "description", "text": "In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T032104", "T032105", "T032102", "T032103", "T032109", "T032106", "T032107", "T019890", "T019891", "T032101", "T018980", "T018981", "T021677", "T022844", "T018983", "T021676", "T028705", "T028706", "T027359", "T032113", "T032111", "T032112", "T032110", "T022835", "T018979", "T024990" ], "last_affected": [ "T028707", "T032108" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2020-15250" } ] }
wid-sec-w-2023-3072
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3072 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3072.json" }, { "category": "self", "summary": "WID-SEC-2023-3072 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3072" }, { "category": "external", "summary": "RedHat Security Advisory vom 2023-12-06", "url": "https://access.redhat.com/errata/RHSA-2023:7669" } ], "source_lang": "en-US", "title": "Red Hat Enterprise Linux(Cryostat): Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-12-06T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:53:19.866+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-3072", "initial_release_date": "2023-12-06T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-06T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8 Cryostat", "product": { "name": "Red Hat Enterprise Linux 8 Cryostat", "product_id": "T031507", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8_cryostat" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-34462", "notes": [ { "category": "description", "text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T031507" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-34462" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T031507" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-24815", "notes": [ { "category": "description", "text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T031507" ] }, "release_date": "2023-12-06T23:00:00Z", "title": "CVE-2023-24815" } ] }
wid-sec-w-2024-0125
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Enterprise Manager (OEM) ist ein Set von System Management Werkzeugen von Oracle f\u00fcr Oracle Umgebungen. Es beinhaltet Werkzeuge zum Monitoring von Oracle Umgebung und zur Automatisierung von Datenbank- und Applikations Administration.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0125 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0125.json" }, { "category": "self", "summary": "WID-SEC-2024-0125 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0125" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Enterprise Manager vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixEM" } ], "source_lang": "en-US", "title": "Oracle Enterprise Manager: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-16T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:56:57.331+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0125", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Enterprise Manager 12.4.0.0", "product": { "name": "Oracle Enterprise Manager 12.4.0.0", "product_id": "T018973", "product_identification_helper": { "cpe": "cpe:/a:oracle:enterprise_manager:12.4.0.0" } } }, { "category": "product_name", "name": "Oracle Enterprise Manager 13.3.0.1", "product": { "name": "Oracle Enterprise Manager 13.3.0.1", "product_id": "T018974", "product_identification_helper": { "cpe": "cpe:/a:oracle:enterprise_manager:13.3.0.1" } } }, { "category": "product_name", "name": "Oracle Enterprise Manager 13.5.0.0", "product": { "name": "Oracle Enterprise Manager 13.5.0.0", "product_id": "T020692", "product_identification_helper": { "cpe": "cpe:/a:oracle:enterprise_manager:13.5.0.0" } } } ], "category": "product_name", "name": "Enterprise Manager" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-20917", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20917" }, { "cve": "CVE-2024-20916", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20916" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-2618", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2618" }, { "cve": "CVE-2023-1436", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-1436" }, { "cve": "CVE-2022-42003", "notes": [ { "category": "description", "text": "In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL-HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T018973", "T018974", "T020692" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-42003" } ] }
wid-sec-w-2023-2625
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM QRadar Security Information and Event Management (SIEM) bietet Unterst\u00fctzung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2625 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2625.json" }, { "category": "self", "summary": "WID-SEC-2023-2625 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2625" }, { "category": "external", "summary": "IBM Security Bulletin 7049133 vom 2023-10-10", "url": "https://www.ibm.com/support/pages/node/7049133" } ], "source_lang": "en-US", "title": "IBM QRadar SIEM: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-10-10T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:47:32.827+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-2625", "initial_release_date": "2023-10-10T22:00:00.000+00:00", "revision_history": [ { "date": "2023-10-10T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM QRadar SIEM \u003c 7.5.0 UP7", "product": { "name": "IBM QRadar SIEM \u003c 7.5.0 UP7", "product_id": "T030425", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up7" } } } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-40367", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-40367" }, { "cve": "CVE-2023-38408", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-38408" }, { "cve": "CVE-2023-35116", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-35116" }, { "cve": "CVE-2023-34981", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34981" }, { "cve": "CVE-2023-34455", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34455" }, { "cve": "CVE-2023-34454", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34454" }, { "cve": "CVE-2023-34453", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34453" }, { "cve": "CVE-2023-34396", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34396" }, { "cve": "CVE-2023-34149", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-34149" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-32697", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-32697" }, { "cve": "CVE-2023-32067", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-32067" }, { "cve": "CVE-2023-30994", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-30994" }, { "cve": "CVE-2023-30441", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-30441" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-29007", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-29007" }, { "cve": "CVE-2023-28709", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-28709" }, { "cve": "CVE-2023-2828", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-2828" }, { "cve": "CVE-2023-26049", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-26049" }, { "cve": "CVE-2023-26048", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-26048" }, { "cve": "CVE-2023-2597", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-2597" }, { "cve": "CVE-2023-25652", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-25652" }, { "cve": "CVE-2023-24998", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-24998" }, { "cve": "CVE-2023-21968", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21968" }, { "cve": "CVE-2023-21967", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21967" }, { "cve": "CVE-2023-21954", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21954" }, { "cve": "CVE-2023-21939", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21939" }, { "cve": "CVE-2023-21938", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21938" }, { "cve": "CVE-2023-21937", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21937" }, { "cve": "CVE-2023-21930", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21930" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2023-20867", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2023-20867" }, { "cve": "CVE-2022-48339", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2022-48339" }, { "cve": "CVE-2022-40609", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2022-40609" }, { "cve": "CVE-2022-3564", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2022-3564" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-21426", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2022-21426" }, { "cve": "CVE-2020-13956", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2020-13956" }, { "cve": "CVE-2016-1000027", "notes": [ { "category": "description", "text": "In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von Puffer\u00fcberl\u00e4ufen, Integer-\u00dcberl\u00e4ufen, unsicherer Behandlung, Use-after-free-Fehlern und einem unsicheren Deserialisierungsfehler. Zu den betroffenen Komponenten geh\u00f6ren Apache Tomcat, Apache Portable Runtime, Apache HttpClient, Java SE, l2cap_reassemble_sdu, c-ares, The Bouncy Castle Crypto Package, Pivota Spring Framework, snappy-java, IBM SDK, GNU Emacs, Fasterxml jackson-databind, VMWare Tools, Eclipse Jetty, OpenSSH, ISC BIND, Apache Struts, Git, SQLite JDBC, Eclipse Openj9 und Google Guava. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "release_date": "2023-10-10T22:00:00Z", "title": "CVE-2016-1000027" } ] }
wid-sec-w-2024-0123
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Oracle Fusion Middleware b\u00fcndelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0123 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0123.json" }, { "category": "self", "summary": "WID-SEC-2024-0123 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0123" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Fusion Middleware vom 2024-01-16", "url": "https://www.oracle.com/security-alerts/cpujan2024.html#AppendixFMW" } ], "source_lang": "en-US", "title": "Oracle Fusion Middleware: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-16T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:56:55.587+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0123", "initial_release_date": "2024-01-16T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-16T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Fusion Middleware 12.2.1.4.0", "product": { "name": "Oracle Fusion Middleware 12.2.1.4.0", "product_id": "751674", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:12.2.1.4.0" } } }, { "category": "product_name", "name": "Oracle Fusion Middleware 14.1.1.0.0", "product": { "name": "Oracle Fusion Middleware 14.1.1.0.0", "product_id": "829576", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:14.1.1.0.0" } } }, { "category": "product_name", "name": "Oracle Fusion Middleware 8.5.6", "product": { "name": "Oracle Fusion Middleware 8.5.6", "product_id": "T024993", "product_identification_helper": { "cpe": "cpe:/a:oracle:fusion_middleware:8.5.6" } } } ], "category": "product_name", "name": "Fusion Middleware" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-20986", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20986" }, { "cve": "CVE-2024-20931", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20931" }, { "cve": "CVE-2024-20930", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20930" }, { "cve": "CVE-2024-20928", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20928" }, { "cve": "CVE-2024-20927", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20927" }, { "cve": "CVE-2024-20908", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2024-20908" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-49093", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-49093" }, { "cve": "CVE-2023-46604", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-46604" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-44483", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-44483" }, { "cve": "CVE-2023-43643", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-43643" }, { "cve": "CVE-2023-42503", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-42503" }, { "cve": "CVE-2023-39410", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-39410" }, { "cve": "CVE-2023-38545", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-38545" }, { "cve": "CVE-2023-3817", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-3817" }, { "cve": "CVE-2023-3635", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-3635" }, { "cve": "CVE-2023-33201", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-33201" }, { "cve": "CVE-2023-32697", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-32697" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-21949", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2023-21949" }, { "cve": "CVE-2022-44729", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-44729" }, { "cve": "CVE-2022-23221", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2022-23221" }, { "cve": "CVE-2021-37533", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-37533" }, { "cve": "CVE-2021-36090", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-36090" }, { "cve": "CVE-2021-33813", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-33813" }, { "cve": "CVE-2021-0341", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2021-0341" }, { "cve": "CVE-2020-5421", "notes": [ { "category": "description", "text": "In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T024993", "751674", "829576" ] }, "release_date": "2024-01-16T23:00:00Z", "title": "CVE-2020-5421" } ] }
gsd-2023-33201
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2023-33201", "id": "GSD-2023-33201" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-33201" ], "details": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "id": "GSD-2023-33201", "modified": "2023-12-13T01:20:36.591075Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2023-33201", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bouncycastle.org", "refsource": "MISC", "url": "https://bouncycastle.org" }, { "name": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "refsource": "CONFIRM", "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc" }, { "name": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "refsource": "MISC", "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "name": "https://security.netapp.com/advisory/ntap-20230824-0008/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20230824-0008/" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-debug-jdk14", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "900f1fe8-09a1-4ab1-a138-4144371e4a79" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-debug-jdk15to18", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "2fb4a005-11da-43a7-baef-24419cce051d" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-debug-jdk18on", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "2c18c87a-011a-4512-bf4f-987fba4778c7" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-ext-jdk14", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "313f49aa-b8fc-4445-a5ec-d397237d5a55" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-ext-jdk15to18", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "9d9c5a3b-e4fb-4fed-bb6a-2f658d3a09b9" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-ext-jdk18on", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "4737d86e-a5a8-49e1-ae91-5c70be7af343" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-jdk14", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "2e5338ee-a0c8-48d9-b945-710166fdfd91" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-jdk15to18", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "a3593afe-c5aa-4728-a8b7-afbf577ecefd" }, { "affected_range": "(,1.74)", "affected_versions": "All versions before 1.74", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2023-08-03", "description": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "fixed_versions": [ "1.74" ], "identifier": "CVE-2023-33201", "identifiers": [ "GHSA-hr8g-6v94-x4m9", "CVE-2023-33201" ], "not_impacted": "All versions starting from 1.74", "package_slug": "maven/org.bouncycastle/bcprov-jdk18on", "pubdate": "2023-07-05", "solution": "Upgrade to version 1.74 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33201", "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "https://bouncycastle.org/releasenotes.html#r1rv74", "https://bouncycastle.org", "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html", "https://github.com/advisories/GHSA-hr8g-6v94-x4m9" ], "uuid": "2b646f5a-fae4-4e37-9e4f-51fd73e53ac1" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.74", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2023-33201" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-295" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc", "refsource": "CONFIRM", "tags": [ "Patch" ], "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc" }, { "name": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201", "refsource": "MISC", "tags": [ "Vendor Advisory" ], "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201" }, { "name": "https://bouncycastle.org", "refsource": "MISC", "tags": [ "Product" ], "url": "https://bouncycastle.org" }, { "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update", "refsource": "MLIST", "tags": [], "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html" }, { "name": "https://security.netapp.com/advisory/ntap-20230824-0008/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20230824-0008/" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4 } }, "lastModifiedDate": "2023-08-24T19:15Z", "publishedDate": "2023-07-05T03:15Z" } } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.