RHSA-2022:5894MediumCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update.

Published
August 3, 2022
Last Modified
August 7, 2026

🔗 CVE IDs covered (3)

CVE-2021-44906 →CVE-2022-24823 →CVE-2022-25647 →

📋 Description

CVE-2021-44906 — minimist: prototype pollution CVE-2022-24823 — netty: world readable temporary file containing sensitive data CVE-2022-25647 — com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

🎯 Affected products200

  • Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-0:1-18.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-0:1-18.el9eap.x86_64 as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-FastInfoset-0:1.2.13-11.1.redhat_1.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-0:2.16.0-9.redhat_00042.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-cli-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-commons-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-core-client-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-dto-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-hornetq-protocol-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-hqclient-protocol-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-jdbc-store-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-jms-client-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-jms-server-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-journal-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-native-1:1.0.2-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-native-1:1.0.2-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-ra-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-selector-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-server-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-service-extensions-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-activemq-artemis-tools-0:2.16.0-9.redhat_00042.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-aesh-extensions-0:1.8.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-aesh-extensions-0:1.8.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-aesh-readline-0:2.2.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-aesh-readline-0:2.2.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-agroal-0:1.3.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-agroal-0:1.3.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • eap7-agroal-api-0:1.3.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9
  • +170 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. For details about how to apply this update, see: https://access.redhat.com/articles/11258 Workaround: As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

🔗 References (33)