Red Hat Security Advisory

RHSA-2020:3806

Red Hat support for Spring Boot 2.2.6.SP2 security update

Released 2020-09-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Runtimes Spring Boot 2.2.6

Fixes 4 records

TI-2020-10912 CVE-2020-13935 · GHSA-m7jv-hq7h-mq7c

Infinite loop in Apache Tomcat

HIGH 81

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.86608 Published 2020-07-14 Partial fix · 10.0.0-M7, 9.0.37 +2 CWE-835

TI-2020-10911 CVE-2020-13934 · GHSA-vf77-8h7g-gghp

Memory leak in Apache Tomcat

HIGH 74

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.64124 Published 2020-07-14 Partial fix · 10.0.0-M6, 9.0.36 +1 CWE-401

TI-2020-08591 CVE-2020-10688 · GHSA-29qj-rvv6-qrmv

Cross-site scripting in RESTEasy

LOW 30

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01388 Published 2021-05-27 Partial fix · 3.11.1.Final, 4.5.3.Final CWE-79

TI-2020-08595 CVE-2020-10693 · GHSA-rmrm-75hp-phr2

Improper input validation in hibernate-validator

LOW 29

A flaw was found in Hibernate Validator version 6.1.2.Final.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02351 Published 2020-05-06 Partial fix · 6.1.5.Final, 6.0.20.Final CWE-20