(RHSA-2023:1855) Moderate: Red Hat JBoss EAP 7.4.10 XP 4.0.0.GA security release

2023-04-1818:57:50

access.redhat.com

red hat jboss

eap 7.4.10

xp 4.0.0.ga

cumulative patch

security fix

protobuf-java

wildfly

information disclosure

cve-2022-3509

cve-2022-3510

cve-2022-1278

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

51.4%

JSON

This is a cumulative patch release zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.10.

Security Fix(es):

protobuf-java: Textformat parsing issue leads to DoS (CVE-2022-3509)
protobuf-java: Message-Type Extensions parsing issue leads to DoS (CVE-2022-3510)
WildFly: possible information disclosure (CVE-2022-1278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.