RHSA-2024:8093HighCVSS 8.8
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2024-47561 — apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
🎯 Affected products1
- Red Hat JBoss Enterprise Application Platform 7
✅ Remediation
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: 1. Avoid parsing user-provided schemas. 2. Ensure proper input validation and sanitization of schemas before parsing. 3. Monitor systems for any unusual activities that may indicate exploitation attempts. 4. Apply the principle of least privilege to minimize the potential impact of successful exploits.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2024:8093
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
- externalhttps://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2316116
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8093.json