title: Red Hat Security Advisory: Red Hat Process Automation Manager 7.8.0 Security Update
description: HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: flood using empty frames results in excessive resource consumption apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId libquartz: XXE attacks via job description netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers cxf: reflected XSS in the services listing page jackson-databind: lacks certain net.sf.ehcache blocking netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header keycloak: security issue on reset credential flow netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.JEditorPane jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime netty: compression/decompression codecs don't enforce limits on buffer allocation sizes jackson-databind: Serialization gadgets in org.springframework:spring-aop jackson-databind: Serialization gadgets in commons-jelly:commons-jelly jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool jackson-databind: serialization in weblogic/oracle-aqjms jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7.8