[WFCORE-6707][WFCORE-6708][WFCORE-6709] CVE-2023-5379 CVE-2024-1459 CVE-2024-1635 Upgrade Undertow, XNIO and JBoss Remoting

[fl4via]

23.x PR: #5876

Jiras:
https://issues.redhat.com/browse/WFCORE-6707 - relates to CVE-2024-1635
https://issues.redhat.com/browse/WFCORE-6708 - relates to CVE-2024-1635
https://issues.redhat.com/browse/WFCORE-6709 - fixes CVE-2023-5379 CVE-2024-1459 CVE-2024-1635

    Release Notes - XNIO - Version 3.8.13.Final

Bug

• [XNIO-427] - ClosedChannelException when NioSocketConduit.handleReady invokes write listener after read listener closes connection

    Release Notes - JBoss Remoting (3+) - Version 5.0.28.Final

Bug

• [REM3-404] - Remoting connections closed during greetings exchange after HTTP upgrade are not properly cleaned after closed

Enhancement

• [REM3-405] - Improve performance of server accept

    Release Notes - Undertow - Version 2.3.12.Final

Bug

• [UNDERTOW-2280] - CVE-2023-5379 AJP request which exceed max-header-size cause JBoss EAP to be marked as error status in httpd as a reverse-proxy
• [UNDERTOW-2336] - CVE-2024-1635 At Http upgrade to remoting, WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener
• [UNDERTOW-2339] - CVE-2024-1459 Directory traversal vulnerability when accessed via proxy
• [UNDERTOW-2345] - ClientEndpointConfig stored SSLContext is ignored by Undertow implementation

[yersan]

Thanks @fl4via