RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 (RHSA-2024:5856)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5856 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

K73059510: Undertow vulnerabilities CVE-2019-10212 and CVE-2020-1745

Security Advisory Description CVE-2019-10212 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. CVE-2020-1745 A file inclusion vulnerability was found...

com.bbossgroups.boot:bboot-starter-undertow (>=5.0.3.8.3, <=6.3.3), com.brinkus.labs:labs-cloud-starter-service (2.0.0) +112 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.21.final)

io.undertow:undertow-core MAVEN version 1.4.21.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bbossgroups.boot:bboot-starter-undertow =5.0.3.8.3, =1.6, =5.0.4, =5.0.4, =5.0.4, =5.0.4, =5.0.4,...

com.artfii.amq:act (0.0.3-snapshot), com.jwebmp.apps:jwebmphomepage (>=0.67.0.12, <=0.67.0.16) +61 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.27.final)

io.undertow:undertow-core MAVEN version 1.4.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.artfii.amq:act 0.0.3-snapshot - com.jwebmp.apps:jwebmphomepage =0.67.0.12, =0.67.0.15, =0.67.0.12,...

com.baidubce.formula:launcher-spring-boot-starter (>=1.3.2.0, <=2.1.1.1), io.atlasmap:atlasmap-standalone (>=1.39.0, <=1.42.10) +62 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.26.final)

io.undertow:undertow-core MAVEN version 1.4.26.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.baidubce.formula:launcher-spring-boot-starter =1.3.2.0, =1.39.0, =0.10.0.release, =1.0.71.release,...

be.yildiz-games:module-webserver-undertow (>=1.0.0, <=1.1.0), br.eti.clairton:ds-test (>=1.0.1, <=1.2.1) +1054 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (>=2.0.0.alpha1, <=2.0.29.final)

io.undertow:undertow-core MAVEN version =2.0.0.alpha1, =1.0.0, =1.0.1, =1.0.2-release, =0.1.0, =0.0.0, =0.0.10, =0.0.11 - com.9isuper.pelecanus:pelecanus-cache 1.0.3.m1 and more Source cves: CVE-2020-1745 Source advisory: OSV:GHSA-GV2W-88HX-8M9R...

com.networknt:audit (>=1.4.1, <=1.4.6), com.networknt:balance (>=1.4.1, <=1.4.6) +48 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.19.final)

io.undertow:undertow-core MAVEN version 1.4.19.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.networknt:audit =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1,...

cn.joylau.code:joylau-spring-boot-device-parent (1.0.release), com.github.piaohao:act-jfinal (1.0) +53 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.15.final)

io.undertow:undertow-core MAVEN version 1.4.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.joylau.code:joylau-spring-boot-device-parent 1.0.release - com.github.piaohao:act-jfinal 1.0 -...

com.github.jmjlbmn:huiche-demo (>=1.0.1, <=1.0.5), com.github.jmjlbmn:huiche-spring-boot-starter (>=1.0.1, <=1.0.6) +124 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.22.final)

io.undertow:undertow-core MAVEN version 1.4.22.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.jmjlbmn:huiche-demo =1.0.1, =1.0.1, =1.0.1.release, =0.5.0, =1.5.8, =1.3.1, =4.10.0-beta2,...

io.inkstand:inkstand-deployment-resteasy (>=0.1.1, <=0.1.2), io.inkstand:inkstand-http-undertow (>=0.1.1, <=0.1.2) +8 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.0.beta3)

io.undertow:undertow-core MAVEN version 1.2.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:inkstand-deployment-resteasy =0.1.1, =0.1.1, =0.0.1, =0.0.1, =4.0.0, =1.0.0.alpha11,...

com.sksamuel.scruffy:scruffy-integrationtest_2.10 (>=1.12.3, <=1.14.0), com.sksamuel.scruffy:scruffy-integrationtest_2.11 (>=1.12.3, <=1.14.0) +56 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.6.final)

io.undertow:undertow-core MAVEN version 1.2.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.10 =1.12.3, =1.12.3, =1.12.3, =1.12.3, =1.12.3, =1.12.3,...

com.gitblit.fathom:fathom-core (>=0.8.0, <=0.8.1), com.gitblit.fathom:fathom-eventbus (>=0.8.0, <=0.8.1) +46 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.3.16.final)

io.undertow:undertow-core MAVEN version 1.3.16.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0,...

io.jboot:jboot (>=1.0-alpha2, <=1.0-alpha4.2), io.mangoo:mangooio-benchmark (>=4.4.0-beta1, <=4.4.0-beta3) +42 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.12.final)

io.undertow:undertow-core MAVEN version 1.4.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.jboot:jboot =1.0-alpha2, =4.4.0-beta1, =3.12.0, =3.12.0, =3.12.0, =3.12.0, =0.2.8, =0.2.8, =0.2.8,...

io.undertow:undertow-servlet (1.0.0.beta6), io.undertow:undertow-websockets-jsr (1.0.0.beta6) potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.0.0.beta6)

io.undertow:undertow-core MAVEN version 1.0.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta6 - io.undertow:undertow-websockets-jsr 1.0.0.beta6 Source cves:...

io.undertow:undertow-servlet (1.0.4.final), io.undertow:undertow-websockets-jsr (1.0.4.final) potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.0.4.final)

io.undertow:undertow-core MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.4.final - io.undertow:undertow-websockets-jsr 1.0.4.final Source cves:...

io.undertow:undertow-servlet (1.3.26.final), io.undertow:undertow-websockets-jsr (1.3.26.final) +9 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.3.26.final)

io.undertow:undertow-core MAVEN version 1.3.26.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.26.final - io.undertow:undertow-websockets-jsr 1.3.26.final -...

io.undertow:undertow-http2-test-suite (1.3.0.cr3), io.undertow:undertow-servlet (1.3.0.cr3) +1 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.3.0.cr3)

io.undertow:undertow-core MAVEN version 1.3.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr3 - io.undertow:undertow-servlet 1.3.0.cr3 -...

io.mangoo:mangooio-core (>=1.1.0-rc1, <=1.1.0-rc2), io.mangoo:mangooio-integration-test (>=1.1.0-rc1, <=1.1.0-rc2) +10 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.11.final)

io.undertow:undertow-core MAVEN version 1.2.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =2.1.0, =15.11.1, =15.11.1,...

com.mpay24.payment:mpay24-payment-sdk (1.0.0.0), com.mpay24.payment:mpay24-soap-base (1.0.0.0) +11 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.0.10.final)

io.undertow:undertow-core MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.mpay24.payment:mpay24-payment-sdk 1.0.0.0 - com.mpay24.payment:mpay24-soap-base 1.0.0.0 -...

com.sksamuel.scruffy:scruffy-integrationtest_2.10 (>=1.12.1, <=1.12.2), com.sksamuel.scruffy:scruffy-integrationtest_2.11 (>=1.12.1, <=1.12.2) +22 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.5.final)

io.undertow:undertow-core MAVEN version 1.2.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.10 =1.12.1, =1.12.1, =1.12.1, =1.12.1, =1.12.1, =1.12.1,...