Red Hat Security AdvisoryRHSA-2021:3205
Red Hat Integration Camel-K 1.4 release and security update
Released 2021-08-18 · Red Hat rating Moderate · View on Red Hat →
Fixes 18 records
Priority CRITICAL 87
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.84968 · Published 2020-11-16 · Partial fix · 1.4.14, 1.4.14-java7 CWE-78
Priority HIGH 80
XStream is a Java library to serialize objects to XML and back again.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.81817 · Published 2020-12-16 · Partial fix · 1.4.15 CWE-918
Priority HIGH 77
XStream is a Java library to serialize objects to XML and back again.
CVSS 3.1MEDIUM 6.8· Network · No auth · No interaction · EPSS 0.82392 · Published 2020-12-16 · Partial fix · 1.4.15 CWE-78
Priority MEDIUM 64
Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.49104 · Published 2021-01-05 · Fixed in 1.11.3 CWE-23
Priority MEDIUM 55
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.40873 · Published 2020-11-12 · Partial fix · 3.4.1, 3.3.8 CWE-79
Priority MEDIUM 45
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.07225 · Published 2020-12-18 · Partial fix · 1.67 CWE-670
Priority MEDIUM 43
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.07024 · Published 2021-06-16 · Partial fix · 3.4.4, 3.3.11 CWE-400
Priority MEDIUM 42
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.04204 · Published 2020-11-24 · Partial fix · 9.1.3 CWE-74
Priority LOW 36
A flaw was found in the Undertow AJP connector.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01375 · Published 2021-02-23 · Partial fix · 2.1.5, 2.0.33 CWE-400
Priority LOW 35
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01312 · Published 2021-03-16 · Partial fix · 4.7.2, 4.11.2 +2 CWE-22
Priority LOW 34
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticat…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00381 · Published 2021-05-27 · Partial fix · 5.2.15, 5.3.7 CWE-269
Priority LOW 34
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00861 · Published 2021-02-03 · Partial fix CWE-372
Priority LOW 34
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.04544 · Published 2020-09-10 · Partial fix · 5.15.12 CWE-306
Priority LOW 31
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.03572 · Published 2021-06-12 · Partial fix · 2.0.24 CWE-789
Priority LOW 31
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.03337 · Published 2021-03-19 · Partial fix · 2.0.23 CWE-789
Priority LOW 30
A carefully crafted PDF file can trigger an infinite loop while loading the file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02993 · Published 2021-03-19 · Partial fix · 2.0.23 CWE-834
Priority LOW 29
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02604 · Published 2021-02-03 · Partial fix · 1.4.21 CWE-276
Priority LOW 27
Apache Groovy provides extension methods to aid with creating temporary directories.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.01027 · Published 2020-12-07 · Partial fix · 2.4.21, 2.5.14 +1 CWE-379
THREATIST.IORead the docs