The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3580.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 8.0.2 Security update Advisory ID: RHSA-2024:3580-03 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2024:3580 Issue date: 2024-06-04 Revision: 03 CVE Names: CVE-2023-4503 ==================================================================== Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.0.1, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.2 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * jberet-core: jberet: jberet-core logging database credentials [eap-8.0.z] (CVE-2024-1102) * eap-galleon: custom provisioning creates unsecured http-invoker [eap-8.0.z] (CVE-2023-4503) * eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-8.0.z] (CVE-2024-1233) * eap: JBoss EAP: OIDC app attempting to access the second tenant, the user should be prompted to log [eap-8.0.z] (CVE-2023-6236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: CVEs: CVE-2023-4503 References: https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/ https://bugzilla.redhat.com/show_bug.cgi?id=2184751 https://bugzilla.redhat.com/show_bug.cgi?id=2250812 https://bugzilla.redhat.com/show_bug.cgi?id=2262060 https://bugzilla.redhat.com/show_bug.cgi?id=2262849 https://issues.redhat.com/browse/JBEAP-25251 https://issues.redhat.com/browse/JBEAP-25263 https://issues.redhat.com/browse/JBEAP-25292 https://issues.redhat.com/browse/JBEAP-25379 https://issues.redhat.com/browse/JBEAP-25638 https://issues.redhat.com/browse/JBEAP-25787 https://issues.redhat.com/browse/JBEAP-26024 https://issues.redhat.com/browse/JBEAP-26205 https://issues.redhat.com/browse/JBEAP-26224 https://issues.redhat.com/browse/JBEAP-26290 https://issues.redhat.com/browse/JBEAP-26407 https://issues.redhat.com/browse/JBEAP-26468 https://issues.redhat.com/browse/JBEAP-26529 https://issues.redhat.com/browse/JBEAP-26532 https://issues.redhat.com/browse/JBEAP-26573 https://issues.redhat.com/browse/JBEAP-26588 https://issues.redhat.com/browse/JBEAP-26635 https://issues.redhat.com/browse/JBEAP-26637 https://issues.redhat.com/browse/JBEAP-26642 https://issues.redhat.com/browse/JBEAP-26651 https://issues.redhat.com/browse/JBEAP-26676 https://issues.redhat.com/browse/JBEAP-26681 https://issues.redhat.com/browse/JBEAP-26758 https://issues.redhat.com/browse/JBEAP-26766 https://issues.redhat.com/browse/JBEAP-26770 https://issues.redhat.com/browse/JBEAP-26806 https://issues.redhat.com/browse/JBEAP-26812 https://issues.redhat.com/browse/JBEAP-26813 https://issues.redhat.com/browse/JBEAP-26832 https://issues.redhat.com/browse/JBEAP-26864 https://issues.redhat.com/browse/JBEAP-26868 https://issues.redhat.com/browse/JBEAP-26881 https://issues.redhat.com/browse/JBEAP-26933 https://issues.redhat.com/browse/JBEAP-26937 https://issues.redhat.com/browse/JBEAP-26954 https://issues.redhat.com/browse/JBEAP-27002 https://issues.redhat.com/browse/JBEAP-27009