Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Published: 2024-04-05

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2023-4639 CVE-2023-48795 CVE-2023-1973 CVE-2024-1635 CVE-2023-3223
CWE-ID	CWE-20 CWE-326 CWE-400
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	eap7-wildfly-elytron (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly (Red Hat package) Operating systems & Components / Operating system package or component eap7-undertow (Red Hat package) Operating systems & Components / Operating system package or component eap7-lucene-solr (Red Hat package) Operating systems & Components / Operating system package or component eap7-jgroups-kubernetes (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-xnio-base (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-server-migration (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-remoting (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-cert-helper (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-annotations (Red Hat package) Operating systems & Components / Operating system package or component eap7-jberet (Red Hat package) Operating systems & Components / Operating system package or component eap7-insights-java-client (Red Hat package) Operating systems & Components / Operating system package or component eap7-infinispan (Red Hat package) Operating systems & Components / Operating system package or component eap7-hibernate (Red Hat package) Operating systems & Components / Operating system package or component eap7-hal-console (Red Hat package) Operating systems & Components / Operating system package or component eap7-elytron-web (Red Hat package) Operating systems & Components / Operating system package or component eap7-eclipse-jgit (Red Hat package) Operating systems & Components / Operating system package or component eap7-apache-cxf (Red Hat package) Operating systems & Components / Operating system package or component eap7-activemq-artemis (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU88155

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4639

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of cookies with certain value-delimiting characters in incoming requests. A remote attacker can construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

eap7-wildfly-elytron (Red Hat package): before 1.15.22-1.Final_redhat_00001.1.el8eap

eap7-wildfly (Red Hat package): before 7.4.16-4.GA_redhat_00002.1.el8eap

eap7-undertow (Red Hat package): before 2.2.30-1.SP1_redhat_00001.1.el8eap

eap7-lucene-solr (Red Hat package): before 5.5.5-6.redhat_2.1.el8eap

eap7-jgroups-kubernetes (Red Hat package): before 1.0.17-1.Final_redhat_00001.1.el8eap

eap7-jboss-xnio-base (Red Hat package): before 3.8.12-1.SP2_redhat_00001.1.el8eap

eap7-jboss-server-migration (Red Hat package): before 1.10.0-35.Final_redhat_00034.1.el8eap

eap7-jboss-remoting (Red Hat package): before 5.0.27-4.SP2_redhat_00001.1.el8eap

eap7-jboss-cert-helper (Red Hat package): before 1.1.2-1.redhat_00001.1.el8eap

eap7-jboss-annotations (Red Hat package): before api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el8eap

eap7-jberet (Red Hat package): before 1.3.9-3.SP3_redhat_00001.1.el8eap

eap7-insights-java-client (Red Hat package): before 1.1.2-1.redhat_00001.1.el8eap

eap7-infinispan (Red Hat package): before 11.0.18-2.Final_redhat_00001.1.el8eap

eap7-hibernate (Red Hat package): before 5.3.36-1.Final_redhat_00001.1.el8eap

eap7-hal-console (Red Hat package): before 3.3.21-1.Final_redhat_00001.1.el8eap

eap7-elytron-web (Red Hat package): before 1.9.4-1.Final_redhat_00001.1.el8eap

eap7-eclipse-jgit (Red Hat package): before 5.13.3.202401111512-1.r_redhat_00001.1.el8eap

eap7-apache-cxf (Red Hat package): before 3.4.10-2.redhat_00001.1.el8eap

eap7-activemq-artemis (Red Hat package): before 2.16.0-18.redhat_00052.1.el8eap

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2024:1675

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Inadequate encryption strength

EUVDB-ID: #VU84537

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48795

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.

The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.