Red Hat Security AdvisoryRHSA-2020:1308
Red Hat Virtualization Engine security, bug fix 4.3.9
Released 2020-04-02 · Red Hat rating Low · View on Red Hat →
Fixed in
- RHV-M 4.3 ovirt-engine-4.3.9.3-0.1.el7, ovirt-engine-backend-4.3.9.3-0.1.el7, ovirt-engine-dbscripts-4.3.9.3-0.1.el7 +21
- Tools for RHV Engine apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
Fixes 2 records
Priority MEDIUM 61
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.29082 · Published 2019-08-20 · Partial fix · 1.9.4 CWE-502
Priority MEDIUM 55
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.11121 · Published 2019-10-15 · Fixed in 7.9 CWE-755
