Issued:: 2025-05-14
Updated:: 2025-05-14

RHSA-2025:7620 - Important: JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.

Synopsis

Important: JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.

Type/Severity

Security Advisory Important

Topic

JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.

Description

JBoss EAP XP 5.0 Update 2.0 GA release. See references for release notes.

Security Fix(es):

org.jboss.narayana-narayana-all: deadlock via multiple join requests sent to LRA Coordinator (CVE-2024-8447)
com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)
org.jboss.eap-jboss-eap-xp: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/jboss_eap_xp_5.0_upgrade_and_migration_guide

Affected Products

Product	Version	Arch
JBoss Enterprise Application Platform	Text-Only Advisories	x86_64

Fixes

CVEs

References

https://access.redhat.com/security/updates/classification/#important

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.