RHSA-2023:5484HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7

Published
October 5, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (7)

CVE-2023-33201 →CVE-2023-34462 →CVE-2022-25883 →CVE-2023-3171 →CVE-2023-4061 →CVE-2023-26136 →CVE-2023-26464 →

📋 Description

CVE-2022-25883 — nodejs-semver: Regular expression denial of service CVE-2023-3171 — eap-7: heap exhaustion via deserialization CVE-2023-4061 — wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor CVE-2023-26136 — tough-cookie: prototype pollution in cookie memstore CVE-2023-26464 — log4j1-socketappender: DoS via hashmap logging CVE-2023-33201 — bouncycastle: potential blind LDAP injection attack using a self-signed certificate CVE-2023-34462 — netty: SniHandler 16MB allocation leads to OOM

🎯 Affected products119

  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-cli-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-commons-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-core-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-dto-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-hornetq-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-hqclient-protocol-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-jdbc-store-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-jms-client-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-jms-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-journal-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-ra-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-selector-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-server-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-service-extensions-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-activemq-artemis-tools-0:2.16.0-15.redhat_00049.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-mail-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-pg-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-pkix-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-prov-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-bouncycastle-util-0:1.76.0-4.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • eap7-hibernate-core-0:5.3.31-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • +89 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Configuration of SniHandler with an idle timeout will mitigate this issue.

🔗 References (27)