CVE-2024-8447
Fixed in a distro release EPSS <1%CVSS 5.9
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
Products: Red Hat JBoss EAP XP 5.0 Update 2.0, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jboss.narayana.rts:lra-coordinator-jar | 7.1.0.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 8.0 | eap8-eap-product-conf-parent | 0:800.6.1-1.GA_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-eap-product-conf-parent | 0:800.6.1-1.GA_redhat_00001.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:800.6.1-1.GA_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:800.6.1-1.GA_redhat_00001.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-buffer | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-buffer | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-dns | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-dns | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-http | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-http | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-socks | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-codec-socks | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-common | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-common | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-handler | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-handler | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-handler-proxy | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-handler-proxy | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-resolver | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-resolver | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-resolver-dns | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-resolver-dns | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-classes-epoll | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-classes-epoll | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-epoll | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-epoll | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-epoll-debuginfo | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-epoll-debuginfo | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-unix-common | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-netty-transport-native-unix-common | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-slf4j | 0:2.0.16-2.redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-slf4j | 0:2.0.16-2.redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-slf4j-api | 0:2.0.16-2.redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-slf4j-api | 0:2.0.16-2.redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk11 | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk11 | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk17 | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk17 | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk21 | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-java-jdk21 | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-modules | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
| Red Hat jboss enterprise application platform 8.0 | eap8-wildfly-modules | 0:8.0.6-15.GA_redhat_00009.1.el9eap |