Red Hat JBoss Fuse 6 vulnerabilities

6 known vulnerabilities in Red Hat JBoss Fuse 6 from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  Migration Toolkit for Runtimes 1 on RHEL 8: Inconsistent Interpretation of HTTP Requests

  CVE-2023-4639Nov 17, 2024Red HatEPSS 1.09%

  A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cook

• 7.5 High severity

  Red Hat JBoss Enterprise Application Platform…: Allocation of Resources Without Limits or Throttling

  CVE-2023-5379Dec 12, 2023Red HatEPSS 1.03%

  A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response

• 7.5 High severity

  Red Hat Fuse 7.12.1: Memory Allocation with Excessive Size Value

  CVE-2023-3223Sep 27, 2023Red HatEPSS 2.66%

  A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit

• 7.5 High severity

  RHINT Camel-K-1.10.1: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-4244Sep 25, 2023Red HatEPSS 1.35%

  A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by us

• 7.5 High severity

  EAP 7.4.10 release: Loop with Unreachable Exit Condition

  CVE-2023-1108Sep 14, 2023Red HatEPSS 1.77%

  A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

• 8.8 High severity

  RHPAM 7.13.1 async: Deserialization of Untrusted Data

  CVE-2022-1415Sep 11, 2023Red HatEPSS 1.04%

  A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the se