title: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update
description: undertow: Information leak in requests for directories without trailing slashes codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. jackson-databind: default typing mishandling leading to remote code execution
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.2::el7