Issued:

2025-01-21

Updated:

2025-01-21

RHSA-2025:0542 - Moderate: JBoss EAP XP 5.0 Update 1.0 release. See references for release notes.

Synopsis

Moderate: JBoss EAP XP 5.0 Update 1.0 release. See references for release notes.

Type/Severity

Security Advisory Moderate

Topic

JBoss EAP XP 5.0 Update 1.0 release. See references for release notes.

Description

JBoss EAP XP 5.0 Update 1.0 GA release. See references for release notes.

Security Fix(es):

• io.vertx/vertx-grpc: Vertx gRPC server does not limit the maximum message size (CVE-2024-8391)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, refer to the Using JBoss EAP XP 5 document: https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/using_jboss_eap_xp_5.0/index

Affected Products

Fixes

• This content is not included.BZ - 2309758
• This content is not included.JBEAP-24664
• This content is not included.JBEAP-26398
• This content is not included.JBEAP-26715
• This content is not included.JBEAP-26776
• This content is not included.JBEAP-26798
• This content is not included.JBEAP-27331
• This content is not included.JBEAP-27358
• This content is not included.JBEAP-27540
• This content is not included.JBEAP-27763
• This content is not included.JBEAP-27773
• This content is not included.JBEAP-27817
• This content is not included.JBEAP-27942
• This content is not included.JBEAP-28074
• This content is not included.JBEAP-28075
• This content is not included.JBEAP-28092
• This content is not included.JBEAP-28146
• This content is not included.JBEAP-28331
• This content is not included.JBEAP-28355
• This content is not included.JBEAP-28357
• This content is not included.JBEAP-28379
• This content is not included.JBEAP-28400

CVEs

• CVE-2024-8391

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/red_hat_jboss_eap_xp_5.0_release_notes/index
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/jboss_eap_xp_5.0_upgrade_and_migration_guide/index
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/using_jboss_eap_xp_5.0/index

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.