Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
Red Hat JBoss Enterprise Application Platform 7. 4. 18 includes multiple security fixes addressing vulnerabilities such as remote memory denial of service (DoS), timing attacks on cryptographic libraries, infinite loops causing DoS, and resource allocation issues. These vulnerabilities affect components including Undertow, BouncyCastle, Netty, and HTTP/2 handling. The update replaces version 7. 4. 17 and is rated with an Important security impact by Red Hat. No CVSS scores are provided in the advisory, but the overall severity is high. The vendor has released this update to remediate the identified issues.
AI Analysis
Technical Summary
Red Hat JBoss Enterprise Application Platform 7.4.18 addresses several security vulnerabilities: CVE-2024-3653 (Undertow LearningPushHandler remote memory DoS), CVE-2024-5971 (Undertow response write hangs with Java 17 TLSv1.3 NewSessionTicket), CVE-2024-30171 (BouncyCastle timing variant of Bleichenbacher attack), CVE-2024-29857 (BouncyCastle EC certificate crafted parameters leading to DoS), CVE-2024-29025 (Netty HTTP codec resource allocation without limits), CVE-2024-30172 (BouncyCastle infinite loop in ED25519 verification), and CVE-2024-27316 (HTTP/2 CONTINUATION frames DoS). These vulnerabilities impact various components of the platform, potentially leading to denial of service or cryptographic weaknesses. The update includes upgraded versions of affected components and is intended to fix these issues.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions through remote memory exhaustion, infinite loops, or hangs in response handling. Additionally, cryptographic weaknesses in BouncyCastle could allow timing attacks or denial of service when processing specially crafted certificates. Resource allocation issues in Netty could be exploited to exhaust system resources. These impacts can degrade service availability or compromise cryptographic operations within the affected platform.
Mitigation Recommendations
Red Hat has released version 7.4.18 of JBoss Enterprise Application Platform 7.4 for RHEL 7 to address these vulnerabilities. Users should apply this update after ensuring all previous errata are applied and backing up their systems. The vendor advisory provides detailed instructions for applying the update. No alternative mitigations or workarounds are indicated; applying the official update is the recommended remediation.
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
Description
Red Hat JBoss Enterprise Application Platform 7. 4. 18 includes multiple security fixes addressing vulnerabilities such as remote memory denial of service (DoS), timing attacks on cryptographic libraries, infinite loops causing DoS, and resource allocation issues. These vulnerabilities affect components including Undertow, BouncyCastle, Netty, and HTTP/2 handling. The update replaces version 7. 4. 17 and is rated with an Important security impact by Red Hat. No CVSS scores are provided in the advisory, but the overall severity is high. The vendor has released this update to remediate the identified issues.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat JBoss Enterprise Application Platform 7.4.18 addresses several security vulnerabilities: CVE-2024-3653 (Undertow LearningPushHandler remote memory DoS), CVE-2024-5971 (Undertow response write hangs with Java 17 TLSv1.3 NewSessionTicket), CVE-2024-30171 (BouncyCastle timing variant of Bleichenbacher attack), CVE-2024-29857 (BouncyCastle EC certificate crafted parameters leading to DoS), CVE-2024-29025 (Netty HTTP codec resource allocation without limits), CVE-2024-30172 (BouncyCastle infinite loop in ED25519 verification), and CVE-2024-27316 (HTTP/2 CONTINUATION frames DoS). These vulnerabilities impact various components of the platform, potentially leading to denial of service or cryptographic weaknesses. The update includes upgraded versions of affected components and is intended to fix these issues.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions through remote memory exhaustion, infinite loops, or hangs in response handling. Additionally, cryptographic weaknesses in BouncyCastle could allow timing attacks or denial of service when processing specially crafted certificates. Resource allocation issues in Netty could be exploited to exhaust system resources. These impacts can degrade service availability or compromise cryptographic operations within the affected platform.
Mitigation Recommendations
Red Hat has released version 7.4.18 of JBoss Enterprise Application Platform 7.4 for RHEL 7 to address these vulnerabilities. Users should apply this update after ensuring all previous errata are applied and backing up their systems. The vendor advisory provides detailed instructions for applying the update. No alternative mitigations or workarounds are indicated; applying the official update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:5143
- Cve Count
- 7
- Additional Cves
- ["CVE-2024-5971","CVE-2024-27316","CVE-2024-29025","CVE-2024-29857","CVE-2024-30171","CVE-2024-30172"]
- Cvss Version
- null
Threat ID: 6a1df669e29bf47b504624c7
Added to database: 6/1/2026, 9:15:21 PM
Last enriched: 6/1/2026, 9:25:22 PM
Last updated: 6/1/2026, 10:26:29 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.