Red Hat JBoss EAP 7.1 Security Advisory RHSA-2024:10208: Multiple CVEs (RCE, SSRF, DoS)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability ID: RHSA-2024:10208 2. Release Date: November 25, 2024 3. Update Date: November 25, 2024 4. Type/Severity: Security Advisory, Important 5. Affected Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS 7.1 x86_64 6. Security Update Details: - bouncycastle: Password bypass possible in OpenBSDBCrypt.checkPassword utility (CVE-2020-28052) - hsqldb: Untrusted input may lead to RCE attack (CVE-2022-41853) - cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding (CVE-2022-23221) - h2: Loading of custom classes from remote servers through JNDI (CVE-2022-46364) - xalan: Integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) - log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464) - xnio: StackOverflowException when the chain of notifier states becomes problematically large (CVE-2023-5685) - server: eap-7: Heap exhaustion via deserialization (CVE-2023-3171) - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) - avro: apache-avro: Apache Avro Java SDK: Memory consumption when deserializing untrusted data in Avro Java SDK (CVE-2023-39410) - avro: apache-avro: Schema parsing may trigger Remote Code Execution (RCE) (CVE-2024-47561) 7. Remediation: Before applying this update, ensure that all previously released patches relevant to your system are already applied. Back up existing installations, including all applications, configuration files, databases, and database settings. 8. Affected Components: Red Hat JBoss Enterprise Application Platform 7.1 EAP 7.1 9. CVE IDs: Multiple CVEs, including CVE-2020-7238, CVE-2020-28052, CVE-2022-23221, etc. 10. References: Multiple documentation and page links, including security update categorization, Red Hat JBoss Enterprise Application Platform 7.1 documentation, etc. This information helps users understand the details of the vulnerabilities, the affected products and components, and how to apply the security updates.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat JBoss EAP 7.1 Security Advisory RHSA-2024:10208: Multiple CVEs (RCE, SSRF, DoS)