RHEL 9：Red Hat JBoss Enterprise Application Platform 8.0.4 安全性更新 (重要) (RHSA-2024:8824)
high Nessus Plugin ID 210414
語系：
概要
遠端 Red Hat 主機缺少一個或多個安全性更新。說明
遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2024:8824 公告中提及的多個弱點影響。Red Hat JBoss Enterprise Application Platform 8 是一個以 WildFly 應用程式執行時間為基礎的 Java 應用程式平台。本版本 Red Hat JBoss Enterprise Application Platform 8.0.4 是 Red Hat JBoss Enterprise Application Platform 8.0.3 的替代版本，其中包含錯誤修正和增強功能。如需此公告中包含的最重要的錯誤修正和增強功能的相關資訊，請參閱 Red Hat JBoss Enterprise Application Platform 8.0.4 版本資訊。
安全性修正：
* org.apache.cxf/cxf-rt-transports-http：CXF HTTP 用戶端中不受限制的記憶體消耗 [eap-8.0.z] (CVE-2024-41172)
* com.nimbusds/nimbus-jose-jwt：大型 JWE p2c 標頭值造成拒絕服務 [eap-8.0.z] (CVE-2023-52428)
* wildfly-domain-http：wildfly：EAP 管理介面不會逾時可能導致拒絕服務 (DoS) [eap-8.0.z] (CVE-2024-4029)
* xalan：OpenJDK：Xalan-J 中存在整數截斷問題 (JAXP，8285407) [eap-8.0.z] (CVE-2022-34169)
* org.keycloak/keycloak-services：Open Redirec 中的重新導向 URI 驗證結果包含弱點 [eap-8.0.z] (CVE-2024-8883)
* org.keycloak/keycloak-saml-core-public：不當驗證 SAML 回應會導致 Keycloak 遭受特權提升攻擊 [eap-8.0.z] (CVE-2024-8698)
* org.keycloak/keycloak-saml-core：不當驗證 SAML 回應會導致 Keycloak 遭受特權提升攻擊 [eap-8.0.z] (CVE-2024-8698)
如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。
Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
更新受影響的套件。另請參閱
https://bugzilla.redhat.com/show_bug.cgi?id=2108554
https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?919aa761
https://bugzilla.redhat.com/show_bug.cgi?id=2278615
https://issues.redhat.com/browse/JBEAP-27002
https://issues.redhat.com/browse/JBEAP-27194
https://bugzilla.redhat.com/show_bug.cgi?id=2311641
https://bugzilla.redhat.com/show_bug.cgi?id=2312511
https://access.redhat.com/errata/RHSA-2024:8824
https://bugzilla.redhat.com/show_bug.cgi?id=2298829
https://bugzilla.redhat.com/show_bug.cgi?id=2309764
https://issues.redhat.com/browse/JBEAP-24945
https://issues.redhat.com/browse/JBEAP-25035
https://issues.redhat.com/browse/JBEAP-27276
https://issues.redhat.com/browse/JBEAP-27293
https://issues.redhat.com/browse/JBEAP-27392
https://issues.redhat.com/browse/JBEAP-27543
https://issues.redhat.com/browse/JBEAP-27585
https://issues.redhat.com/browse/JBEAP-27643
https://issues.redhat.com/browse/JBEAP-27659
https://issues.redhat.com/browse/JBEAP-27688
https://issues.redhat.com/browse/JBEAP-27694
https://issues.redhat.com/browse/JBEAP-27957
https://issues.redhat.com/browse/JBEAP-28057
https://issues.redhat.com/browse/JBEAP-28278
https://issues.redhat.com/browse/JBEAP-28289
Plugin 詳細資訊
嚴重性: High
ID: 210414
檔案名稱: redhat-RHSA-2024-8824.nasl
版本: 1.1
類型: local
代理程式: unix
已發布: 2024/11/6
已更新: 2024/11/6
支援的感應器: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
風險資訊
VPR
風險因素: High
分數: 8.5
Vendor
Vendor Severity: Important
CVSS v2
風險因素: High
基本分數: 7.8
時間分數: 6.1
媒介: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS 評分資料來源: CVE-2022-34169
CVSS v3
風險因素: High
基本分數: 7.7
時間分數: 6.9
媒介: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
時間媒介: CVSS:3.0/E:P/RL:O/RC:C
CVSS 評分資料來源: CVE-2024-8698
弱點資訊
CPE: p-cpe:/a:redhat:enterprise_linux:eap8-apache-commons-codec, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-restat-api, p-cpe:/a:redhat:enterprise_linux:eap8-wildfly, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-selector, p-cpe:/a:redhat:enterprise_linux:eap8-jakarta-servlet-jsp-jstl, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:redhat:enterprise_linux:eap8-wildfly-modules, p-cpe:/a:redhat:enterprise_linux:eap8-jgroups, p-cpe:/a:redhat:enterprise_linux:eap8-apache-cxf, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-jdbc-store, p-cpe:/a:redhat:enterprise_linux:eap8-jmespath-java, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-hqclient-protocol, p-cpe:/a:redhat:enterprise_linux:eap8-apache-commons-lang, p-cpe:/a:redhat:enterprise_linux:eap8-asyncutil, p-cpe:/a:redhat:enterprise_linux:eap8-aws-java-sdk-kms, p-cpe:/a:redhat:enterprise_linux:eap8-hppc, p-cpe:/a:redhat:enterprise_linux:eap8-insights-java-client, p-cpe:/a:redhat:enterprise_linux:eap8-objectweb-asm, p-cpe:/a:redhat:enterprise_linux:eap8-aws-java-sdk, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis, p-cpe:/a:redhat:enterprise_linux:eap8-apache-commons-io, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-jts-integration, p-cpe:/a:redhat:enterprise_linux:eap8-wildfly-java-jdk17, p-cpe:/a:redhat:enterprise_linux:eap8-cryptacular, p-cpe:/a:redhat:enterprise_linux:eap8-hibernate, p-cpe:/a:redhat:enterprise_linux:eap8-snakeyaml, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-jakarta-ra, p-cpe:/a:redhat:enterprise_linux:eap8-hibernate-envers, p-cpe:/a:redhat:enterprise_linux:eap8-apache-cxf-rt, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-cli, p-cpe:/a:redhat:enterprise_linux:eap8-apache-cxf-tools, p-cpe:/a:redhat:enterprise_linux:eap8-eap-product-conf-parent, p-cpe:/a:redhat:enterprise_linux:eap8-nimbus-jose-jwt, p-cpe:/a:redhat:enterprise_linux:eap8-wildfly-java-jdk11, p-cpe:/a:redhat:enterprise_linux:eap8-eap-product-conf-wildfly-ee-feature-pack, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-jakarta-service-extensions, p-cpe:/a:redhat:enterprise_linux:eap8-artemis-native-wildfly, p-cpe:/a:redhat:enterprise_linux:eap8-jctools-core, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-restat-util, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-commons, p-cpe:/a:redhat:enterprise_linux:eap8-hibernate-core, p-cpe:/a:redhat:enterprise_linux:eap8-aws-java-sdk-core, p-cpe:/a:redhat:enterprise_linux:eap8-aesh-readline, p-cpe:/a:redhat:enterprise_linux:eap8-aesh-extensions, p-cpe:/a:redhat:enterprise_linux:eap8-pem-keystore, p-cpe:/a:redhat:enterprise_linux:eap8-resteasy-tracing-api, p-cpe:/a:redhat:enterprise_linux:eap8-objectweb-asm-util, p-cpe:/a:redhat:enterprise_linux:eap8-log4j, p-cpe:/a:redhat:enterprise_linux:eap8-slf4j-api, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-jts-idlj, p-cpe:/a:redhat:enterprise_linux:eap8-jctools, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-journal, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-server, p-cpe:/a:redhat:enterprise_linux:eap8-jboss-logging, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-hornetq-protocol, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-jbossxts, p-cpe:/a:redhat:enterprise_linux:eap8-resteasy-spring, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-jakarta-server, p-cpe:/a:redhat:enterprise_linux:eap8-artemis-native, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-jbosstxbridge, p-cpe:/a:redhat:enterprise_linux:eap8-hibernate-validator, p-cpe:/a:redhat:enterprise_linux:eap8-resteasy-extensions, p-cpe:/a:redhat:enterprise_linux:eap8-apache-commons-collections, p-cpe:/a:redhat:enterprise_linux:eap8-saaj-impl, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-jakarta-client, p-cpe:/a:redhat:enterprise_linux:eap8-narayana, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-restat-bridge, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-dto, p-cpe:/a:redhat:enterprise_linux:eap8-shibboleth-java-support, p-cpe:/a:redhat:enterprise_linux:eap8-slf4j, p-cpe:/a:redhat:enterprise_linux:eap8-fastinfoset, p-cpe:/a:redhat:enterprise_linux:eap8-jboss-cert-helper, p-cpe:/a:redhat:enterprise_linux:eap8-jakarta-servlet-jsp-jstl-api, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-native, p-cpe:/a:redhat:enterprise_linux:eap8-wildfly-java-jdk21, p-cpe:/a:redhat:enterprise_linux:eap8-activemq-artemis-core-client, p-cpe:/a:redhat:enterprise_linux:eap8-hibernate-validator-cdi, p-cpe:/a:redhat:enterprise_linux:eap8-narayana-restat-integration, p-cpe:/a:redhat:enterprise_linux:eap8-apache-cxf-services, p-cpe:/a:redhat:enterprise_linux:eap8-artemis-wildfly-integration, p-cpe:/a:redhat:enterprise_linux:eap8-aws-java-sdk-s3
必要的 KB 項目: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2024/11/4
弱點發布日期: 2022/7/19
參考資訊
CVE: CVE-2022-34169, CVE-2023-52428, CVE-2024-4029, CVE-2024-41172, CVE-2024-8698, CVE-2024-8883