Latest redhat jboss data grid Vulnerabilities

● CVE-2023-44487

- Rapid Reset HTTP/2 vulnerability

Microsoft Windows 11=21H2

Microsoft Windows Server 2022

Microsoft Windows 11=22H2

and 553 more

● CVE-2023-5384

Infinispan: credentials returned from configuration as clear text

<8.4.6

● CVE-2023-5236

Circular reference on marshalling leads to dos

<8.4.4

● CVE-2023-3629

Non-admins should not be able to get cache config via rest api

<8.4.4

● CVE-2023-3628

Rest bulk ops don't check permissions

<8.4.4

● CVE-2022-1271

Tukaani XZ Utils xzgrep Argument Injection Remote Code Execution Vulnerability

redhat/gzip<0:1.5-11.el7_9

redhat/xz<0:5.2.2-2.el7_9

redhat/gzip<0:1.9-13.el8_5

redhat/xz<0:5.2.4-4.el8_6

redhat/gzip<0:1.9-10.el8_1

redhat/xz<0:5.2.4-4.el8_1

and 17 more

● CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

redhat/log4j<0:1.2.14-6.5.el6_10

redhat/log4j<0:1.2.17-17.el7_4

redhat/log4j<0:1.2.17-16.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 219 more

● CVE-2020-25689

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able ...

redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea

redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea

and 63 more

● CVE-2020-25644

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest t...

maven/org.wildfly.openssl:wildfly-openssl-natives-parent<1.1.3.Final

redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea

redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea

redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea

redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea

and 67 more

● CVE-2020-14340

A flaw was found in xnio. A file descriptor leak caused by growing amounts of NIO Selector file, handled between garbage collection cycles, may allow the attacker to cause a denial of service. The hig...

redhat/eap7-activemq-artemis<0:2.9.0-5.redhat_00011.1.el6ea

redhat/eap7-activemq-artemis-native<1:1.0.2-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-codec<0:1.14.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-lang<0:3.10.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-cxf<0:3.3.7-1.redhat_00001.1.el6ea

redhat/eap7-artemis-native<1:1.0.2-3.redhat_1.el6ea

and 102 more

● CVE-2020-1710

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 111 more

● CVE-2019-14888

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the se...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 79 more

● CVE-2019-14887

It was found that the OpenSSL security provider does not honor TLS version in 'enabled-protocols' value of Wildfly's legacy security configuration. An attacker could target traffic sent over a TLS con...

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

redhat/eap7-hal-console<0:3.0.20-1.Final_redhat_00001.1.el6ea

and 224 more

● CVE-2019-14892

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 ...

FasterXML jackson-databind>=2.0.0<2.6.7.3

FasterXML jackson-databind>=2.7.0<2.8.11.5

FasterXML jackson-databind>=2.9.0<2.9.10

Redhat Decision Manager=7.0

Redhat Jboss Data Grid

Redhat Jboss Data Grid=7.0.0

and 86 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

● CVE-2019-10212

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

redhat/Undertow<2.0.27.

redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea

redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el6ea

and 110 more

● CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

<=9.4.14

=7.0.0

Infinispan Infinispan<=9.4.14

Redhat Jboss Data Grid=7.0.0

maven/org.infinispan:infinispan-core<9.4.15.Final

● CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

maven/io.undertow:undertow-servlet<2.0.23

redhat/undertow<2.0.23.

redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea

redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea

and 117 more

● CVE-2019-10174

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's...

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el6ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el7ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el7ea

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el8ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el8ea

and 14 more

● CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchang...

redhat/eap7-apache-commons-codec<0:1.11.0-2.redhat_00001.1.el6ea

redhat/eap7-apache-cxf<0:3.2.7-2.redhat_00002.1.el6ea

redhat/eap7-hal-console<0:3.0.11-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.10-1.Final_redhat_00001.1.el6ea

redhat/eap7-hornetq<0:2.4.7-7.Final_redhat_2.1.el6ea

redhat/eap7-ironjacamar<0:1.4.16-2.Final_redhat_00001.1.el6ea

and 79 more

● CVE-2019-14900

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is use...

redhat/Hibernate ORM<5.3.18

redhat/Hibernate ORM<5.4.18

redhat/Hibernate ORM<5.5.0.

redhat/Hibernate ORM 5.3.17.Final-redhat<00001

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

and 125 more

● CVE-2020-1757

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servl...

redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea

redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea

redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea

redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea

and 273 more

● CVE-2018-1131

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious obje...

redhat/Infinispan<9.4.0.

redhat/Infinispan<9.3.1.

Infinispan Infinispan=8.2.10

Infinispan Infinispan=9.0.3

Infinispan Infinispan=9.1.7

Infinispan Infinispan=9.2.2

and 2 more

Latest redhat jboss data grid Vulnerabilities

Company

Resources

Contact