An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.

A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerability is availability.(incomplete fix for CVE-2021-3629)

Moderate: Red Hat JBoss Enterprise Application Platform 7.4.15 Security update

Low: Red Hat JBoss Enterprise Application Platform 7.4 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.16 Security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update

Important: Red Hat JBoss Enterprise Application Platform 7.4 security update

Critical: Red Hat JBoss Enterprise Application Platform 7.4 security update

Moderate: Red Hat JBoss Enterprise Application Platform 7.4.20 Security update

Important: Red Hat JBoss Enterprise Application Platform 7.4 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.21 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4 .21 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): undertow: DoS can be achieved as Undertow server waits for the LASTCHUNK forever for EJB invocations (CVE-2022-2764) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat JBoss Enterprise Application Platform 7.4.13 security update

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.Security Fix(es): log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.This release of Red Hat JBoss Enterprise Application Platform 7.4.3 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.2 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.3 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859) EAP 7: Incomplete fix of CVE-2016-4978 in HornetQ library (CVE-2021-20318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat JBoss Enterprise Application Platform 7.4.12 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.14 security update

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jbossas init script and its content executed with root privileges when jbossas service is started, stopped or restarted.

It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations.

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

A long URL when sent to EAP 7 Server operating as a reverse proxy with default buffer sizes causes a DoS.

A long URL (about 1900 characters) is sent, the proxy server

return error 500 (that's ok) starts to consume 100% CPU starts to fill logs log file with exceptions very fast (so disk space gets exhausted quickly) E.g. some infinite loop is initiated by the request. Proxy server must be restarted to stop the problem.

Important: JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.

Important: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Important: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Moderate: Red Hat JBoss Enterprise Application Platform 8.0.7 security update