Red Hat Security Advisory

RHSA-2018:2946

Red Hat OpenShift Application Runtimes security and bug fix update

Released 2018-10-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Text-Only RHOAR

Fixes 2 records

TI-2018-09003 CVE-2018-12544 · GHSA-qh3m-qw6v-qvhg

XML external entity injection in Eclipse Vert.x

MEDIUM 46

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02172 Published 2018-10-10 Fixed in 3.5.4 CWE-611

TI-2018-09000 CVE-2018-12541 · GHSA-45xm-v8gq-7jqx

Memory corruption in Eclipse Vert.x

LOW 34

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02652 Published 2018-10-10 Partial fix · 3.5.4 CWE-789