title: Red Hat Security Advisory: Red Hat Data Grid 7.3.7 security update
description: jetty: HTTP request smuggling using the range header jetty: HTTP request smuggling jetty: Incorrect header handling jackson-mapper-asl: XML external entity similar to CVE-2016-3720 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class EAP: field-name is not parsed in accordance to RFC7230 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain undertow: AJP File Read/Inclusion Vulnerability Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass jackson-databind: Lacks certain xbean-reflect/JNDI blocking log4j: improper validation of certificate with host mismatch in SMTP appender jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution wildfly-elytron: session fixation when using FORM authentication jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.JEditorPane jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime netty: compression/decompression codecs don't enforce limits on buffer allocation sizes jackson-databind: Serialization gadgets in org.springframework:spring-aop jackson-databind: Serialization gadgets in commons-jelly:commons-jelly
cpes: cpe:/a:redhat:jboss_data_grid:7.3