Read the docs
Red Hat Security Advisory

RHSA-2020:2561

EAP Continuous Delivery Technical Preview Release 12 security update

Released 2020-06-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 5 records

TI-2017-09354 CVE-2017-12629 · GHSA-mh7g-99w9-xpjm

XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1

Priority CRITICAL 85

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.91896 Published 2017-10-14 Partial fix · lucene-solr 7.2.0, lucene-solr 8.0.0 +4 CWE-611
TI-2017-11063 CVE-2017-15089 · GHSA-46r5-59fg-2fjc

Deserialization of untrusted data in infinispan

Priority MEDIUM 43

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02827 Published 2018-02-15 Partial fix · 9.2.0.CR1 CWE-502
TI-2017-08964 CVE-2017-12174 · GHSA-gc96-h5pr-839j

Uncontrolled resource consumption in Red Hat HornetQ/Artemis

Priority MEDIUM 42

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05976 Published 2018-03-07 Fixed in 2.4.0, 2.4.0.Final CWE-400
TI-2017-08986 CVE-2017-12196 · GHSA-cp7v-vmv7-6x2q

Improper authentication in undertow

Priority LOW 30

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP r…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02011 Published 2018-04-18 Partial fix · 2.0.2.FInal, 1.4.24.Final CWE-287