Red Hat Security AdvisoryRHSA-2020:3585
EAP Continuous Delivery Technical Preview Release 20 security update
Released 2020-08-31 · Red Hat rating Important · View on Red Hat →
Fixes 13 records
Priority MEDIUM 52
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07269 · Published 2020-05-01 · Partial fix · 2.0.3, 2.1.3 CWE-611
Priority MEDIUM 51
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.08028 · Published 2020-03-18 · Partial fix · 2.9.10.4, 2.6.7.4 CWE-502
Priority MEDIUM 50
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.17044 · Published 2019-11-18 · Partial fix CWE-611
Priority MEDIUM 45
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.09188 · Published 2020-04-07 · Partial fix · 4.1.46 CWE-770
Priority MEDIUM 41
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.10124 · Published 2021-06-02 · Partial fix · 2.3.14 CWE-22
Priority MEDIUM 40
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04425 · Published 2018-07-18 · Partial fix · 2.3.7 CWE-22
Priority LOW 37
A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.02067 · Published 2020-06-22 · Partial fix · 20.0.0.Final CWE-502
Priority LOW 36
A flaw was found in WildFly Elytron version 1.11.3.Final and before.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.01454 · Published 2020-09-23 · Partial fix · 1.11.4 CWE-384
Priority LOW 36
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01465 · Published 2020-06-10 · Partial fix · 2.1.1.Final CWE-770
Priority LOW 33
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.
CVSS 3.1MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.06147 · Published 2020-04-01 · Partial fix · 3.2.13, 3.3.6 CWE-200
Priority LOW 33
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02126 · Published 2020-07-06 · Partial fix · 5.3.18, 5.4.18 +1 CWE-89
Priority LOW 31
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01002 · Published 2020-05-26 · Partial fix · 2.1.1.Final CWE-444
Priority LOW 25
A flaw was found in wildfly.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00575 · Published 2021-06-07 · Partial fix · 20.0.0.Final CWE-270
THREATIST.IORead the docs