widely-deployed-product-advisoryinternet-facing-service-vulnerabilityopen-source-dependency-vulnerability
Red Hat JBoss EAP 7.4.12 Fixes Three Denial-of-Service Vulnerabilities
Patch & Detection Intelligence · 5 sources · Updated 2mo ago · First seen Aug 7, 2023
Red Hat released JBoss Enterprise Application Platform (EAP) 7.4.12, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: CVE-2023-3223, CVE-2021-46877, and CVE-2023-1436. The update is rated Important and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison.
Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
Patch this, or something else?See real exploitation activity before you spend the cycle.
Triage this advisory
