Red Hat Security AdvisoryRHSA-2017:2546
Red Hat JBoss BPM Suite 6.4.5 security update
Released 2017-08-29 · Red Hat rating Important · View on Red Hat →
Fixes 3 records
Priority HIGH 75
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.37721 · Published 2018-02-06 · Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184
Priority LOW 39
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files.
CVSS 3.0HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.04118 · Published 2017-04-18 · Partial fix · 1.9 CWE-611
Priority LOW 37
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02366 · Published 2017-05-21 · Partial fix · 1.9.2 CWE-200
