Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 7 |
| CVE-ID | CVE-2022-25883 CVE-2023-3171 CVE-2023-4061 CVE-2023-26136 CVE-2023-26464 CVE-2023-33201 CVE-2023-34462 |
| CWE-ID | CWE-185 CWE-400 CWE-264 CWE-1321 CWE-90 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
eap7-wildfly-elytron (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly (Red Hat package) Operating systems & Components / Operating system package or component eap7-undertow (Red Hat package) Operating systems & Components / Operating system package or component eap7-resteasy (Red Hat package) Operating systems & Components / Operating system package or component eap7-netty-transport-native-epoll (Red Hat package) Operating systems & Components / Operating system package or component eap7-netty (Red Hat package) Operating systems & Components / Operating system package or component eap7 (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-xnio-base (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-server-migration (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-modules (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-marshalling (Red Hat package) Operating systems & Components / Operating system package or component eap7-ironjacamar (Red Hat package) Operating systems & Components / Operating system package or component eap7-hibernate (Red Hat package) Operating systems & Components / Operating system package or component eap7-hal-console (Red Hat package) Operating systems & Components / Operating system package or component eap7-bouncycastle (Red Hat package) Operating systems & Components / Operating system package or component eap7-activemq-artemis (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
1) Incorrect Regular Expression
EUVDB-ID: #VU78932
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-25883
CWE-ID:
CWE-185 - Incorrect Regular Expression
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application via the new Range function and perform regular expression denial of service (ReDos) attack.
Install updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Resource exhaustion
EUVDB-ID: #VU82197
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-3171
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. A remote attacker can send specially crafted requests using these classes to trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU81930
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4061
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper privilege management in the RBAC implementation. A remote user can use the resolve-expression in the HAL interface to read system properties from the Wildfly system.
Install updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Prototype pollution
EUVDB-ID: #VU80323
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-26136
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
Install updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Resource exhaustion
EUVDB-ID: #VU73244
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-26464
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (i.e., deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed can exhaust the available memory in the virtual machine and achieve denial of service when the object is deserialized.
MitigationInstall updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) LDAP injection
EUVDB-ID: #VU78328
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-33201
CWE-ID:
CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper input validation in applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. A remote non-authenticated attacker can use a specially crafted X.509 certificate to bypass authentication process and gain unauthorized access to the application.
MitigationInstall updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Resource exhaustion
EUVDB-ID: #VU77573
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-34462
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources if no idle timeout handler was configured. A remote attacker can send a client hello packet, which leads the server to buffer up to 16MB of data per connection and results in a denial of service condition.
Install updates from vendor's website.
eap7-wildfly-elytron (Red Hat package): before 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package): before 7.4.13-8.GA_redhat_00001.1.el9eap
eap7-undertow (Red Hat package): before 2.2.26-1.SP1_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package): before 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package): before 4.1.94-1.Final_redhat_00001.1.el9eap
eap7 (Red Hat package): before mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package): before 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package): before 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package): before 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-jboss-marshalling (Red Hat package): before 2.0.13-2.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package): before 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package): before 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package): before 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package): before 1.76.0-4.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package): before 2.16.0-15.redhat_00049.1.el9eap
CPE2.3- cpe:2.3:o:red_hat:eap7-wildfly-elytron_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-wildfly_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-undertow_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-resteasy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty-transport-native-epoll_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-netty_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-xnio-base_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-server-migration_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-modules_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-jboss-marshalling_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-ironjacamar_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hibernate_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-hal-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-bouncycastle_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:eap7-activemq-artemis_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:5486
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
