Red Hat JBoss Data Grid 7 vulnerabilities
17 known vulnerabilities in Red Hat JBoss Data Grid 7 from Red Hat. 17 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
A flaw was found in Undertow that can cause remote denial of service attacks.
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause
- 8.1 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Restriction of Excessive Authentication Attempts
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
- 7.4 High severity
Migration Toolkit for Runtimes 1 on RHEL 8: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cook
- 7.3 High severity
Red Hat JBoss Enterprise Application Platform 7: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the s
- 7.5 High severity
HawtIO 4.0.0 for Red Hat build of Apache Camel 4: Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a resu
- 7.5 High severity
Red Hat build of Apache Camel 3.20.7 for…: Uncontrolled Recursion
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response.
- 7.5 High severity
EAP 8.0.1: Exposure of Data Element to Wrong Session
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to inco
- 7.4 High severity
Red Hat AMQ Broker 7: Origin Validation Error
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicatio
- 8.1 High severity
Migration Toolkit for Runtimes 1 on RHEL 8: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct
- 7.5 High severity
Red Hat build of Apache Camel 4.4.0 for Spring…: Uncontrolled Resource Consumption
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).
- 7.5 High severity
Red Hat build of Apache Camel 4.4.1 for Spring…: Uncontrolled Resource Consumption
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the
- 7.1 High severity
Red Hat build of Keycloak 22: URL Redirection to Untrusted Site
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Allocation of Resources Without Limits or Throttling
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response
- 7.5 High severity
Red Hat Fuse 7.12.1: Memory Allocation with Excessive Size Value
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit
- 7.5 High severity
RHINT Camel-K-1.10.1: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by us
- 7.5 High severity
EAP 7.4.10 release: Loop with Unreachable Exit Condition
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
- 8.8 High severity
RHPAM 7.13.1 async: Deserialization of Untrusted Data
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the se