Red Hat JBoss EAP 7.3 Security Advisory (RHSA-2024:10207) Fixing Multiple CVEs

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: RHSA-2024:10207 2. Release Date: November 25, 2024 3. Update Date: November 25, 2024 4. Type/Severity: Security Advisory, Important 5. Affected Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS 7.3 x86_64 6. Security Update Content: - Apache CXF SSRF Vulnerability - Loading of custom classes from remote servers through JNDI - Unsafe deserialization flaw in Chainsaw log viewer - SQL injection in Log4j 1.x - Remote code execution in Log4j 1.x - Integer truncation issue in Xalan-J - StackOverflowException when the chain of notifier states becomes problematically big - Untrusted input may lead to RCE attack - Client side invocation timeout raised when calling EJB over HTTP and HTTP2 - Schema parsing may trigger Remote Code Execution (RCE) 7. Remediation Steps: - Ensure all previously released security updates relevant to the system have been applied. - Back up existing installations, including all applications, configuration files, databases, and database settings. - Reference Link: https://access.redhat.com/articles/11258 8. Affected CVE IDs: - CVE-2021-3859 - CVE-2021-4104 - CVE-2022-23221 - CVE-2022-23305 - CVE-2022-23307 - CVE-2022-34169 - CVE-2022-41853 - CVE-2022-46364 - CVE-2022-3171 - CVE-2022-5685 - CVE-2022-26464 - CVE-2022-39410 - CVE-2022-28752 - CVE-2022-47561 This information provides a detailed description of the vulnerability, affected products, security update contents, remediation steps, and associated CVE IDs, helping users understand and address the security issues.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat JBoss EAP 7.3 Security Advisory (RHSA-2024:10207) Fixing Multiple CVEs

More from this source