Red Hat JBoss Enterprise Application Platform Text-Only Advisories vulnerabilities

3 CVEs affecting Red Hat JBoss Enterprise Application Platform Text-Only Advisories, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-3223, published 2023-09-27.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-7238, published 2020-01-27. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue…
• CVE-2023-3223, published 2023-09-27. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of…
• CVE-2011-2487, published 2020-03-11. Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days. The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.