title: Heap exhaustion via deserialization
description: A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
problem types: Memory Allocation with Excessive Size Value
affected:
{
product: eap
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: EAP 7.4.13
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: server
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-15.redhat_00049.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-bouncycastle
defaultStatus: affected
versions:
version: 0:1.76.0-4.redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.19-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.31-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-ironjacamar
defaultStatus: affected
versions:
version: 0:1.5.15-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-marshalling
defaultStatus: affected
versions:
version: 0:2.0.13-2.SP1_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-modules
defaultStatus: affected
versions:
version: 0:1.12.2-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-31.Final_redhat_00030.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.10-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-mod_cluster
defaultStatus: affected
versions:
version: 0:1.4.5-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty-transport-native-epoll
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-resteasy
defaultStatus: affected
versions:
version: 0:3.15.8-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.26-1.SP1_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-15.redhat_00049.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-bouncycastle
defaultStatus: affected
versions:
version: 0:1.76.0-4.redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.19-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.31-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-ironjacamar
defaultStatus: affected
versions:
version: 0:1.5.15-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-marshalling
defaultStatus: affected
versions:
version: 0:2.0.13-2.SP1_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-modules
defaultStatus: affected
versions:
version: 0:1.12.2-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-31.Final_redhat_00030.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.10-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-mod_cluster
defaultStatus: affected
versions:
version: 0:1.4.5-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty-transport-native-epoll
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-resteasy
defaultStatus: affected
versions:
version: 0:3.15.8-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.26-1.SP1_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-15.redhat_00049.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-bouncycastle
defaultStatus: affected
versions:
version: 0:1.76.0-4.redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.19-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.31-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-ironjacamar
defaultStatus: affected
versions:
version: 0:1.5.15-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-marshalling
defaultStatus: affected
versions:
version: 0:2.0.13-2.SP1_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-modules
defaultStatus: affected
versions:
version: 0:1.12.2-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-31.Final_redhat_00030.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.10-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-mod_cluster
defaultStatus: affected
versions:
version: 0:1.4.5-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-netty-transport-native-epoll
defaultStatus: affected
versions:
version: 0:4.1.94-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-resteasy
defaultStatus: affected
versions:
version: 0:3.15.8-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.26-1.SP1_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]