title: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update
description: Artemis: Deserialization of untrusted input vulnerability solr: Directory traversal via Index Replication HTTP API jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6::el7