Red Hat JBoss EAP 7.4.6 Fixes Gson, HAL and Netty Vulnerabilities
Patch & Detection Intelligence · 20 sources · Updated 2mo ago · First seen Aug 8, 2022
Red Hat released JBoss Enterprise Application Platform (EAP) 7.4.6, replacing EAP 7.4.5, to remediate three moderate-severity vulnerabilities in bundled components. The update fixes CVE-2022-25647, Gson deserialization of untrusted data; CVE-2021-44906, prototype pollution in the minimist dependency used by JBoss HAL; and CVE-2022-24823, a Netty issue in which world-readable temporary files could expose sensitive information. The advisory applies to EAP 7.4 deployments, including those on Red Hat Enterprise Linux 8.
Organizations running JBoss EAP 7.4 should install previously released relevant errata and upgrade to EAP 7.4.6. The release follows EAP 7.4.5, which had addressed 15 security issues across components including H2, Netty, Jackson Databind, OpenJDK, Undertow, WildFly, and ActiveMQ Artemis; Red Hat also tracked subsequent maintenance upgrades for Jackson Databind and Artemis in the 7.4.z stream.
