title: Red Hat Security Advisory: eap7-jboss-ec2-eap security update
description: RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) resteasy: Vary header not added by CORS filter leading to cache poisoning undertow: improper whitespace parsing leading to potential HTTP request smuggling EAP-7: Wrong privileges on multiple property files jboss: unsafe chown of server.log in jboss init script allows privilege escalation (Incomplete fix for CVE-2016-8656) Solr: Code execution via entity expansion
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7::el6 cpe:/a:redhat:jboss_enterprise_application_platform:7::el7