rhsa-2024_10208
Vulnerability from csaf_redhat
Published
2024-11-25 00:12
Modified
2024-12-17 23:06
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
Notes
Topic
A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible [eap-7.1.z] (CVE-2020-28052)
* hsqldb: Untrusted input may lead to RCE attack [eap-7.1.z] (CVE-2022-41853)
* cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding [eap-7.1.z] (CVE-2024-28752)
* h2: Loading of custom classes from remote servers through JNDI [eap-7.1.z] (CVE-2022-23221)
* CXF: Apache CXF: SSRF Vulnerability [eap-7.1.z] (CVE-2022-46364)
* xalan: integer truncation issue in Xalan-J (JAXP, 8285407) [eap-7.1.z] (CVE-2022-34169)
* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging [eap-7.1.z] (CVE-2023-26464)
* xnio: StackOverflowException when the chain of notifier states becomes problematically big [eap-7.1.z] (CVE-2023-5685)
* server: eap-7: heap exhaustion via deserialization [eap-7.1.z] (CVE-2023-3171)
* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling [eap-7.1.z] (CVE-2020-7238)
* avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK [eap-7.1.z] (CVE-2023-39410)
* avro: apache-avro: Schema parsing may trigger Remote Code Execution (RCE) [eap-7.1.z] (CVE-2024-47561)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible [eap-7.1.z] (CVE-2020-28052)\n\n* hsqldb: Untrusted input may lead to RCE attack [eap-7.1.z] (CVE-2022-41853)\n\n* cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding [eap-7.1.z] (CVE-2024-28752)\n\n* h2: Loading of custom classes from remote servers through JNDI [eap-7.1.z] (CVE-2022-23221)\n\n* CXF: Apache CXF: SSRF Vulnerability [eap-7.1.z] (CVE-2022-46364)\n\n* xalan: integer truncation issue in Xalan-J (JAXP, 8285407) [eap-7.1.z] (CVE-2022-34169)\n\n* log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging [eap-7.1.z] (CVE-2023-26464)\n\n* xnio: StackOverflowException when the chain of notifier states becomes problematically big [eap-7.1.z] (CVE-2023-5685)\n\n* server: eap-7: heap exhaustion via deserialization [eap-7.1.z] (CVE-2023-3171)\n\n* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling [eap-7.1.z] (CVE-2020-7238)\n\n* avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK [eap-7.1.z] (CVE-2023-39410)\n\n* avro: apache-avro: Schema parsing may trigger Remote Code Execution (RCE) [eap-7.1.z] (CVE-2024-47561)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:10208",
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "1796225",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796225"
},
{
"category": "external",
"summary": "1912881",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912881"
},
{
"category": "external",
"summary": "2044596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044596"
},
{
"category": "external",
"summary": "2108554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2108554"
},
{
"category": "external",
"summary": "2136141",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136141"
},
{
"category": "external",
"summary": "2155682",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682"
},
{
"category": "external",
"summary": "2182864",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864"
},
{
"category": "external",
"summary": "2213639",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639"
},
{
"category": "external",
"summary": "2241822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241822"
},
{
"category": "external",
"summary": "2242521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242521"
},
{
"category": "external",
"summary": "2270732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270732"
},
{
"category": "external",
"summary": "2316116",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
},
{
"category": "external",
"summary": "JBEAP-27708",
"url": "https://issues.redhat.com/browse/JBEAP-27708"
},
{
"category": "external",
"summary": "JBEAP-28086",
"url": "https://issues.redhat.com/browse/JBEAP-28086"
},
{
"category": "external",
"summary": "JBEAP-28130",
"url": "https://issues.redhat.com/browse/JBEAP-28130"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10208.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update",
"tracking": {
"current_release_date": "2024-12-17T23:06:48+00:00",
"generator": {
"date": "2024-12-17T23:06:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.3"
}
},
"id": "RHSA-2024:10208",
"initial_release_date": "2024-11-25T00:12:13+00:00",
"revision_history": [
{
"date": "2024-11-25T00:12:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-11-25T00:12:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-12-17T23:06:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.8.11.6-1.SP1_redhat_00001.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.5.10-1.Final_redhat_00001.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"product": {
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"product_id": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-avro@1.7.6-2.redhat_00003.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src",
"product": {
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src",
"product_id": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-xalan-j2@2.7.1-26.redhat_00015.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-3.SP1_redhat_00001.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.15-1.Final_redhat_00001.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"product": {
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"product_id": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-bouncycastle@1.68.0-1.redhat_00005.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"product": {
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"product_id": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-h2database@1.4.197-2.redhat_00005.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"product": {
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"product_id": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.1.8-2.GA_redhat_00002.1.ep7.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.8.11.6-1.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-xnio-base@3.5.10-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"product": {
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"product_id": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-avro@1.7.6-2.redhat_00003.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"product": {
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"product_id": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-xalan-j2@2.7.1-26.redhat_00015.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-3.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-rt@3.1.16-3.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-services@3.1.16-3.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-tools@3.1.16-3.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-marshalling@2.0.15-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-marshalling-river@2.0.15-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product": {
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_id": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-bouncycastle@1.68.0-1.redhat_00005.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product": {
"name": "eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_id": "eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-bouncycastle-mail@1.68.0-1.redhat_00005.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product": {
"name": "eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_id": "eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-bouncycastle-pkix@1.68.0-1.redhat_00005.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product": {
"name": "eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_id": "eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-bouncycastle-prov@1.68.0-1.redhat_00005.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"product": {
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"product_id": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-h2database@1.4.197-2.redhat_00005.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.1.8-2.GA_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.1.8-2.GA_redhat_00002.1.ep7.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch"
},
"product_reference": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src"
},
"product_reference": "eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
},
"product_reference": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src"
},
"product_reference": "eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
},
"product_reference": "eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
},
"product_reference": "eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
},
"product_reference": "eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch"
},
"product_reference": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src"
},
"product_reference": "eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src"
},
"product_reference": "eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch"
},
"product_reference": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
},
"product_reference": "eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-7238",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2020-01-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1796225"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, where it mishandles Transfer-Encoding whitespace. This flaw allows HTTP Request Smuggling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform ships a vulnerable netty library as part of the logging-elasticsearch5 container. ElasticSearch\u0027s security team has stated that the previous vulnerability, CVE-2019-16869, does not poses a substantial practical threat to ElasticSearch 6 [1]. We agree that this issue would be difficult to exploit both these vulnerabilities on OpenShift Container Platform, so we\u0027re reducing the impact of this issue to moderate and may fix it in the future release.\n\nRed Hat Satellite ships vulnerable netty version embedded in Candlepin, however, is not directly vulnerable since HTTP requests are handled by Tomcat and not netty.\n\n[1] https://github.com/elastic/elasticsearch/issues/49396",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7238"
},
{
"category": "external",
"summary": "RHBZ#1796225",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796225"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7238",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7238"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7238",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7238"
},
{
"category": "external",
"summary": "https://netty.io/news/2019/12/18/4-1-44-Final.html",
"url": "https://netty.io/news/2019/12/18/4-1-44-Final.html"
}
],
"release_date": "2020-01-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "* Use HTTP/2 instead (clear boundaries between requests)\n* Disable reuse of backend connections eg. ```http-reuse never``` in HAProxy or whatever equivalent LB settings",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling"
},
{
"cve": "CVE-2020-28052",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2021-01-05T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1912881"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-28052"
},
{
"category": "external",
"summary": "RHBZ#1912881",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912881"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-28052",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28052"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28052",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28052"
}
],
"release_date": "2020-12-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "Users unable to upgrade to version 1.67 or greater can copy the `OpenBSDBCrypt.doCheckPassword()` method implementation (https://github.com/bcgit/bc-java/blob/r1rv67/core/src/main/java/org/bouncycastle/crypto/generators/OpenBSDBCrypt.java#L259-L343) into their own utility class and supplement it with the required methods and variables as required",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible"
},
{
"cve": "CVE-2022-23221",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-01-19T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2044596"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "h2: Loading of custom classes from remote servers through JNDI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift Container Platform (OCP) the openshift-enterprise-3.11/metrics-hawkular-metrics-container container image ships a vulnerable version of h2 as part of the underlying images, but as it uses standard configuration and Console is not enabled/started by default, therefore the impact by this vulnerability is LOW and will not be fixed as OCP 3.x has already reached End of Full Support.\n\n[1] https://access.redhat.com/support/policy/updates/openshift_noncurrent",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-23221"
},
{
"category": "external",
"summary": "RHBZ#2044596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-23221",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23221"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-45hx-wfhj-473x",
"url": "https://github.com/advisories/GHSA-45hx-wfhj-473x"
}
],
"release_date": "2022-01-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "h2: Loading of custom classes from remote servers through JNDI"
},
{
"cve": "CVE-2022-34169",
"cwe": {
"id": "CWE-192",
"name": "Integer Coercion Error"
},
"discovery_date": "2022-07-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2108554"
}
],
"notes": [
{
"category": "description",
"text": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-34169"
},
{
"category": "external",
"summary": "RHBZ#2108554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2108554"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-34169",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34169"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169"
}
],
"release_date": "2022-07-19T20:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)"
},
{
"cve": "CVE-2022-41853",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2022-10-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2136141"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HSQLDB package. This flaw allows untrusted inputs to execute remote code due to any static method of any Java class in the classpath, resulting in code execution by default.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hsqldb: Untrusted input may lead to RCE attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41853"
},
{
"category": "external",
"summary": "RHBZ#2136141",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136141"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41853",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41853"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853"
},
{
"category": "external",
"summary": "http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control",
"url": "http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-77xx-rxvh-q682",
"url": "https://github.com/advisories/GHSA-77xx-rxvh-q682"
}
],
"release_date": "2022-10-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "By default, the static methods of any class that is on the classpath are available for use and can compromise security in some systems. The optional Java system property, hsqldb.method_class_names, allows preventing access to classes other than java.lang.Math or specifying a semicolon-separated list of allowed classes. A property value that ends with .* is treated as a wild card and allows access to all class or method names formed by substitution of the * (asterisk).\n\nIn the example below, the property has been included as an argument to the Java command.\n\n java -Dhsqldb.method_class_names=\"org.me.MyClass;org.you.YourClass;org.you.lib.*\" [the rest of the command line]\n\nThe above example allows access to the methods in the two classes: org.me.MyClass and org.you.YourClass together with all the classes in the org.you.lib package. Note that if the property is not defined, no access control is performed at this level.\n\nThe user who creates a Java routine must have the relevant access privileges on the tables that are used inside the Java method.\n\nOnce the routine has been defined, the normal database access control applies to its user. The routine can be executed only by those users who have been granted EXECUTE privileges on it. Access to routines can be granted to users with GRANT EXECUTE or GRANT ALL. For example, GRANT EXECUTE ON myroutine TO PUBLIC.\n\nIn hsqldb 2.7.1, all classes by default are not accessible, except those in java.lang.Math and need to be manually enabled.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hsqldb: Untrusted input may lead to RCE attack"
},
{
"cve": "CVE-2022-46364",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2022-12-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2155682"
}
],
"notes": [
{
"category": "description",
"text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSRF Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-46364"
},
{
"category": "external",
"summary": "RHBZ#2155682",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46364"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364"
},
{
"category": "external",
"summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2",
"url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2"
}
],
"release_date": "2022-12-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSRF Vulnerability"
},
{
"cve": "CVE-2023-3171",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"discovery_date": "2023-04-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2213639"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "eap-7: heap exhaustion via deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-3171"
},
{
"category": "external",
"summary": "RHBZ#2213639",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-3171",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3171"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3171"
}
],
"release_date": "2023-10-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "eap-7: heap exhaustion via deserialization"
},
{
"cve": "CVE-2023-5685",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-10-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2241822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xnio: StackOverflowException when the chain of notifier states becomes problematically big",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as an Important impact as the uncontrolled resource consumption may lead to Denial of Service (DoS). This might be intentioned by an attacker who is looking to jeopardize an environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-5685"
},
{
"category": "external",
"summary": "RHBZ#2241822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-5685",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5685"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-5685",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5685"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "There is currently no mitigation available for this vulnerability. Please keep the packages up-to-date as the updates become available.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "xnio: StackOverflowException when the chain of notifier states becomes problematically big"
},
{
"cve": "CVE-2023-26464",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2182864"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j1-socketappender: DoS via hashmap logging",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8 and 9 security impacts have been reduced to Low as they do not enable the vulnerable JDK by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-26464"
},
{
"category": "external",
"summary": "RHBZ#2182864",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182864"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-26464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26464"
},
{
"category": "external",
"summary": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464",
"url": "https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464"
}
],
"release_date": "2023-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j1-socketappender: DoS via hashmap logging"
},
{
"cve": "CVE-2023-39410",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2023-10-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2242521"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in apache-avro. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints, leading to an out-of-memory error and a denial of service on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-39410"
},
{
"category": "external",
"summary": "RHBZ#2242521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242521"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-39410",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39410"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39410",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39410"
},
{
"category": "external",
"summary": "https://issues.apache.org/jira/browse/AVRO-3819",
"url": "https://issues.apache.org/jira/browse/AVRO-3819"
}
],
"release_date": "2023-09-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK"
},
{
"cve": "CVE-2024-28752",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2024-03-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2270732"
}
],
"notes": [
{
"category": "description",
"text": "A server-side request forgery (SSRF) vulnerability was found in Apache CXF. This issue occurs in attacks on webservices that take at least one parameter of any type, and when Aegisdatabind is used. Users of other data bindings including the default databinding are not impacted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important impact due to the fact this requires Aegis databind, which is not the default databinding for Apache CXF.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-28752"
},
{
"category": "external",
"summary": "RHBZ#2270732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-28752",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28752"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-28752",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28752"
},
{
"category": "external",
"summary": "https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt",
"url": "https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-qmgx-j96g-4428",
"url": "https://github.com/advisories/GHSA-qmgx-j96g-4428"
}
],
"release_date": "2024-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this vulnerability. Please make sure to update as the fixes become available.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding"
},
{
"cve": "CVE-2024-47561",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2024-10-02T14:04:06.018000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2316116"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-47561"
},
{
"category": "external",
"summary": "RHBZ#2316116",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
}
],
"release_date": "2024-10-03T12:20:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-25T00:12:13+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10208"
},
{
"category": "workaround",
"details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-mail-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-pkix-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-bouncycastle-prov-0:1.68.0-1.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jboss-marshalling-river-0:2.0.15-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.8-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.