RHSA-2022:5458HighCVSS 8.8
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update
🔗 CVE IDs covered (6)
📋 Description
CVE-2020-13935 — tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS CVE-2020-14384 — jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS CVE-2021-4104 — log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender CVE-2022-23302 — log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink CVE-2022-23305 — log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23307 — log4j: Unsafe deserialization flaw in Chainsaw log viewer
🔗 References (13)
- selfhttps://access.redhat.com/errata/RHSA-2022:5458
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/html-single/installation_guide/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1857024
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1871928
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1875176
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2031667
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041949
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041959
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041967
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5458.json