redhat jboss enterprise application platform 7.2.4 vulnerabilities and exploits

(subscribe to this query)

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1...

Redhat Jboss-remoting 5.0.14 Redhat Jboss-remoting Redhat Undertow 2.0.25 Redhat Undertow Redhat Jboss Enterprise Application Platform Netapp Active Iq Unified Manager -

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped wit...

Redhat Single Sign-on 7.3 Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on -

1 Github repository

A flaw was found in wildfly-core prior to 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

Redhat Wildfly Core 7.0.0 Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Jboss Enterprise Application Platform 7.2.5 Redhat Jboss Enterprise Application Platform 7.3.0 Redhat Single Sign-on 7.3.5 Redhat Data Grid 7.3.4 Redhat Jboss Enterprise Application Platform 7.2.4

1 Github repository

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Data Grid Redhat Jboss Enterprise Application Platform -Redhat Jboss Fuse Redhat Openshift Application Runtimes -Redhat Single Sign-on Netapp Active Iq Unified Manager -Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by impleme...

Redhat Jboss Enterprise Application Platform 7.2.0

SubTypeValidator.java in FasterXML jackson-databind prior to 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

1 Github repository

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Openshift Application Runtimes -Redhat Openshift Application Runtimes 1.0 Redhat Single Sign-on -Redhat Single Sign-on 7.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Single Sign-on 7.3 Netapp Active Iq Unified Manager -

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.9.1 might allow malicious users to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Fasterxml Jackson-databind Debian Debian Linux 8.0 Redhat Enterprise Linux 7.4 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 7.5 Redhat Enterprise Linux 7.6 Redhat Enterprise Linux 7.7

5 Github repositories

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and previous versions have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fi...

Bouncycastle Fips Java Api Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Debian Debian Linux 9.0 Oracle Retail Xstore Point Of Service 7.1 Oracle Api Gateway 11.1.2.4.0 Oracle Weblogic Server 12.1.3.0.0 Oracle Enterprise Repository 12.1.3.0.0 Oracle Retail Xstore Point Of Service 7.0 Oracle Peoplesoft Enterprise Peopletools 8.55 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Soa Suite 12.1.3.0.0 Oracle Soa Suite 12.2.1.3.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Managed File Transfer 12.2.1.3.0 Oracle Communications Converged Application Server Oracle Communications Webrtc Session Controller Oracle Retail Convenience And Fuel Pos Software 2.8.1

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook