CVE-2021-20318
Fixed in a distro release EPSS 2%
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Products: redhat jboss_enterprise_application_platform
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq | 0:2.4.8-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq | 0:2.4.8-1.Final_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-commons | 0:2.4.8-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-commons | 0:2.4.8-1.Final_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-core-client | 0:2.4.8-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-core-client | 0:2.4.8-1.Final_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-jms-client | 0:2.4.8-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-hornetq-jms-client | 0:2.4.8-1.Final_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-undertow | 0:2.2.13-1.SP2_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-undertow | 0:2.2.13-1.SP2_redhat_00001.1.el8eap |