Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.1

CVE-2024-7254 is a stack overflow vulnerability in the Protocol Buffers component used by Red Hat Trusted Profile Analyzer 1.2.0 and Red Hat JBoss Enterprise Application Platform. This vulnerability could potentially lead to denial of service or other impacts related to stack overflow conditions. Red Hat has released Trusted Profile Analyzer version 1.2.1 as an update to address this issue. The vulnerability is also fixed in JBoss EAP XP 5.0 Update 2.0. The Red Hat advisories recommend upgrading to these fixed versions to mitigate the vulnerability.

The vulnerability involves a stack overflow in Protocol Buffers, which can cause application instability or denial of service. The security impact is rated as Moderate for Red Hat Trusted Profile Analyzer 1.2.0. No active exploitation has been reported. The issue affects the stability and reliability of the affected products but does not have a publicly disclosed CVSS score or detailed impact metrics.

Red Hat recommends upgrading Red Hat Trusted Profile Analyzer from version 1.2.0 to 1.2.1 to address this vulnerability. For JBoss Enterprise Application Platform, users should apply the JBoss EAP XP 5.0 Update 2.0 release which includes the fix for CVE-2024-7254. There are no other workarounds or mitigations indicated. Users should ensure all relevant errata and updates are applied as per Red Hat's guidance.