RHSA-2020:0727

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.

An issue was discovered in H2 1.4.197.

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.

A vulnerability was found in Undertow web server before 2.0.21.

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.

undertow before version 2.0.23.Final is vulnerable to an information leak issue.

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system.