Red Hat Security Advisory

RHSA-2019:0910

Red Hat Fuse 7.3 security update

Released 2019-04-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Fuse 7.3

Fixes 4 records

TI-2014-00106 CVE-2014-0112 · GHSA-prjv-jj26-wf8h

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to…

HIGH 78

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted reques…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.98056 Published 2014-04-29 Fixed in 2.3.20 CWE-264

TI-2017-05167 CVE-2017-7525 · GHSA-qxxx-2pp7-5hmx

Deserialization of untrusted data in FasterXML jackson-databind

HIGH 75

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.37721 Published 2018-02-06 Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184

TI-2017-05293 CVE-2017-7657 · GHSA-vgg8-72f2-qm23

Integer overflow in Eclipse Jetty

MEDIUM 57

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14371 Published 2018-06-26 Partial fix · 9.3.24, 9.4.11 +2 CWE-444

TI-2019-00171 CVE-2019-0194 · GHSA-4wjq-69rc-8wcp

Path traversal in Apache Camel

MEDIUM 44

Apache Camel's File is vulnerable to directory traversal.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08482 Published 2019-04-30 Partial fix · 2.21.5, 2.22.3 +1 CWE-22