RHSA-2024:3385MediumCVSS 7.5
Red Hat Security Advisory: Red Hat JBoss EAP 7.4.14 XP 4.0.2.GA security release
🔗 CVE IDs covered (3)
📋 Description
CVE-2023-3635 — okio: GzipSource class improper exception handling CVE-2023-26048 — jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() CVE-2023-26049 — jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies
🎯 Affected products1
- Red Hat JBoss Enterprise Application Platform Expansion Pack
✅ Remediation
For details on how to apply this update, refer to the Using JBoss EAP XP 4 document: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/using_jboss_eap_xp_4.0.0/index
🔗 References (12)
- selfhttps://access.redhat.com/errata/RHSA-2024:3385
- externalhttps://access.redhat.com/security/updates/classification/#moderate
- externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/red_hat_jboss_eap_xp_4.0.0_release_notes/index
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/jboss_eap_xp_4.0_upgrade_and_migration_guide/index
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/using_jboss_eap_xp_4.0.0/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2229295
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2236340
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2236341
- externalhttps://issues.redhat.com/browse/JBEAP-24592
- externalhttps://issues.redhat.com/browse/JBEAP-25932
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3385.json