RHSA-2025:9582HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Published
June 25, 2025
Last Modified
August 10, 2026

🔗 CVE IDs covered (14)

CVE-2021-28170 →CVE-2021-37137 →CVE-2023-5379 →CVE-2024-1233 →CVE-2020-10740 →CVE-2020-13949 →CVE-2020-25644 →CVE-2020-27782 →CVE-2021-37136 →CVE-2022-1259 →CVE-2022-3143 →CVE-2022-4492 →CVE-2020-25638 →CVE-2020-36518 →

📋 Description

CVE-2020-10740 — wildfly: unsafe deserialization in Wildfly Enterprise Java Beans CVE-2020-13949 — libthrift: potential DoS when processing untrusted payloads CVE-2020-25638 — hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used CVE-2020-25644 — wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL CVE-2020-27782 — undertow: special character in query results in server errors CVE-2020-36518 — jackson-databind: denial of service via a large depth of nested objects CVE-2021-28170 — jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate CVE-2021-37136 — netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37137 — netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way CVE-2022-1259 — undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629) CVE-2022-3143 — wildfly-elytron: possible timing attacks via use of unsafe comparator CVE-2022-4492 — undertow: Server identity in https connection is not checked by the undertow client CVE-2023-5379 — undertow: AJP Request closes connection exceeding maxRequestSize CVE-2024-1233 — EAP: wildfly-elytron has a SSRF security issue

🎯 Affected products38

  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-glassfish-el-0:3.0.1-4.b08_redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-glassfish-el-0:3.0.1-4.b08_redhat_00005.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-glassfish-el-impl-0:3.0.1-4.b08_redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-core-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-entitymanager-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-envers-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-infinispan-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-hibernate-java8-0:5.1.17-3.Final_redhat_00004.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-jackson-databind-0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-jackson-databind-0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-jboss-ejb-client-0:4.0.12-1.Final_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-jboss-ejb-client-0:4.0.12-1.Final_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-netty-0:4.1.63-2.Final_redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-netty-0:4.1.63-2.Final_redhat_00003.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-netty-all-0:4.1.63-2.Final_redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-undertow-0:1.4.18-16.SP14_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-undertow-0:1.4.18-16.SP14_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-0:7.1.11-4.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-0:7.1.11-4.GA_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-elytron-0:1.1.14-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-elytron-0:1.1.14-1.Final_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-http-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-http-client-common-0:1.0.21-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-http-ejb-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-http-naming-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-http-transaction-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • eap7-wildfly-modules-0:7.1.11-4.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • +8 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: There is currently no known mitigation for this issue. Workaround: Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters. Workaround: The issue can be mitigated by using HTTP/1.1 instead of AJP to proxy to the back-end. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (21)