RHSA-2022:5928MediumCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update

Published
August 8, 2022
Last Modified
September 17, 2026

🔗 CVE IDs covered (3)

CVE-2021-44906 →CVE-2022-24823 →CVE-2022-25647 →

📋 Description

CVE-2021-44906 — minimist: prototype pollution CVE-2022-24823 — netty: world readable temporary file containing sensitive data CVE-2022-25647 — com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

🎯 Affected products200

  • Red Hat JBoss Enterprise Application Platform
  • @babel.code-frame-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.core-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.generator-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.helper-function-name-7.1.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.helper-get-function-arity-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.helper-split-export-declaration-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.helpers-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.highlight-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.parser-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.template-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.traverse-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
  • @babel.types-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
  • @mrmlnc.readdir-enhanced-2.2.1 as a component of Red Hat JBoss Enterprise Application Platform
  • @nodelib.fs.stat-1.1.3 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.c3-0.6.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-4.13.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-array-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-axis-1.0.10 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-brush-1.0.8 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-chord-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-collection-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-color-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-dispatch-1.0.6 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-drag-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-dsv-1.0.33 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-ease-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-force-1.1.1 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-format-1.3.0 as a component of Red Hat JBoss Enterprise Application Platform
  • @types.d3-geo-1.10.3 as a component of Red Hat JBoss Enterprise Application Platform
  • +170 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. For details about how to apply this update, see: https://access.redhat.com/articles/11258 Workaround: As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

🔗 References (33)