RHSA-2023:5488HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update

Published
October 5, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (7)

CVE-2023-26136 →CVE-2023-26464 →CVE-2023-33201 →CVE-2023-34462 →CVE-2022-25883 →CVE-2023-3171 →CVE-2023-4061 →

📋 Description

CVE-2022-25883 — nodejs-semver: Regular expression denial of service CVE-2023-3171 — eap-7: heap exhaustion via deserialization CVE-2023-4061 — wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor CVE-2023-26136 — tough-cookie: prototype pollution in cookie memstore CVE-2023-26464 — log4j1-socketappender: DoS via hashmap logging CVE-2023-33201 — bouncycastle: potential blind LDAP injection attack using a self-signed certificate CVE-2023-34462 — netty: SniHandler 16MB allocation leads to OOM

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 7

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Configuration of SniHandler with an idle timeout will mitigate this issue.

🔗 References (27)