title: Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 19 security update
description: thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods cxf: OpenId Connect token service does not properly validate the clientId cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* cxf: reflected XSS in the services listing page jackson-databind: lacks certain net.sf.ehcache blocking netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class Soteria: security identity corruption across concurrent threads undertow: AJP File Read/Inclusion Vulnerability netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.JEditorPane jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_cd:19