What does upgrading JBoss 6.4.24 to 7.2.4 fix?

Upgrading JBoss from 6.4.24 to 7.2.4 clears 6 known vulnerabilities (3 high). 3 known issues remain in 7.2.4.

JBoss: 6.4.24 → 7.2.4

Red Hat · upgrade impact

From6.4.247 known issues To7.2.43 known issues

Upgrade impact: Major upgrade. Crossing a major version usually means breaking changes. Review the vendor’s upgrade / migration guide and test before you roll it out.

Fixed by upgrading to 7.2.4 iVulnerabilities that affect 6.4.24 but no longer affect 7.2.4 — the security gain from this upgrade, by exploited status then exploitation probability.

Exploited first, then by exploitation probability (EPSS).

CVE-2016-5406 HIGH EPSS 3% ✓ cleared in 7.2.4 CVE-2016-4993 MEDIUM EPSS 3% ✓ cleared in 7.2.4 CVE-2016-7061 LOW EPSS 2% ✓ cleared in 7.2.4 CVE-2019-19343 HIGH EPSS 2% ✓ cleared in 7.2.4 CVE-2017-12167 MEDIUM EPSS 0% ✓ cleared in 7.2.4 CVE-2016-7066 HIGH EPSS 0% ✓ cleared in 7.2.4

Still open in 7.2.4 iKnown vulnerabilities that affect 7.2.4 too — upgrading to it does not clear these.

These affect 7.2.4 as well — a later release may be needed.

CVE-2019-14838 MEDIUM EPSS 1% → see advisory CVE-2022-0866 MEDIUM EPSS 1% → see advisory CVE-2019-14885 MEDIUM EPSS 1% → fixed in 7.2.6