RHEL 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.0.6 (RHSA-2025:3357)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3357 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2024-8447

creationtimestamp| type| source ---|---|--- 2025-01-02 22:37:28+00:00| seen| https://t.me/cvedetector/14191 2025-02-26 03:24:40+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5442...

org.jboss.narayana.rts:lra-coordinator (5.10.0.final) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.10.0.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.10.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator 5.10.0.final Source cves:...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.11.3.final), org.jboss.narayana.rts:lra-coordinator-thorntail (5.11.3.final) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.11.3.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.11.3.final -...

org.jboss.narayana.rts:lra-test-arquillian-extension (6.0.0.cr1) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (6.0.0.cr1)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 6.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-test-arquillian-extension 6.0.0.cr1 Source...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.11.0.final), org.jboss.narayana.rts:lra-coordinator-thorntail (5.11.0.final) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.11.0.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.11.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.11.0.final -...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.12.7.final), org.jboss.narayana.rts:lra-test-arquillian-extension (5.12.7.final) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.12.7.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.12.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.12.7.final -...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.13.0.final), org.jboss.narayana.rts:lra-test-arquillian-extension (5.13.0.final) potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.13.0.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.13.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.13.0.final -...

org.jboss.narayana.rts:lra-test-arquillian-extension (>=7.0.0.final, <=7.0.2.final), org.wildfly:wildfly-feature-pack-galleon-shared (>=30.0.0.beta1, <=34.0.1.final) +3 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (>=7.0.0.final, <=7.0.2.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version =7.0.0.final, =7.0.0.final, =30.0.0.beta1, =30.0.0.beta1, =30.0.0.beta1, =30.0.0.beta1, =34.0.1.final Source cves: CVE-2024-8447 Source advisory: OSV:GHSA-QQ9F-Q439-2574...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.12.4.final), org.jboss.narayana.rts:lra-coordinator-thorntail (5.12.4.final) +1 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.12.4.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.12.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.12.4.final -...

org.jboss.narayana.rts:lra-coordinator-quarkus (5.12.2.final), org.jboss.narayana.rts:lra-coordinator-thorntail (5.12.2.final) +1 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (5.12.2.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 5.12.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-coordinator-quarkus 5.12.2.final -...

org.jboss.narayana.rts:lra-test-arquillian-extension (6.0.1.final), org.wildfly:wildfly-feature-pack-galleon-shared (>=29.0.0.alpha1, <=29.0.1.final) +3 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (6.0.1.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 6.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-test-arquillian-extension 6.0.1.final -...

CVE-2024-8447

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of...

org.jboss.narayana.rts:lra-coordinator (>=5.10.0.final, <=5.10.6.final), org.jboss.narayana.rts:lra-coordinator-jar-jakarta (>=5.13.1.alpha1, <=5.13.1.final) +8 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (>=5.10.0.final, <=7.0.2.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version =5.10.0.final, =5.10.0.final, =5.13.1.alpha1, =5.11.0.final, =5.10.5.final, =5.12.1.final, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =28.0.0.beta1, =28.0.0.beta1, =34.0.1.final Source cves: CVE-2024-8447 Source advisory: MEND:CVE-2024-8...

CVE-2024-8447 Narayana: deadlock via multiple join requests sent to lra coordinator

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of...

CVE-2024-8447

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of...