Read the docs
Red Hat Security Advisory

RHSA-2021:3225

Red Hat AMQ Streams 1.8.0 release and security update

Released 2021-08-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 12 records

TI-2021-09394 CVE-2021-28165 · GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

Priority HIGH 71

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53861 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-400
TI-2021-09393 CVE-2021-28164 · GHSA-v7ff-8wcx-gmc5

Information disclosure in Eclipse Jetty

Priority HIGH 65

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.82371 Published 2021-04-01 Partial fix · 9.4.39 CWE-200
TI-2021-09398 CVE-2021-28169 · GHSA-gwcr-j4wh-j3cq

Information disclosure in Eclipse Jetty

Priority MEDIUM 64

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.7848 Published 2021-06-09 Partial fix · 9.4.41, 10.0.3 +1 CWE-200
TI-2021-04395 CVE-2021-21295 · GHSA-wm47-8v5p-wjpj

Possible request smuggling in HTTP/2 due missing validation

Priority MEDIUM 50

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.18891 Published 2021-03-09 Partial fix · 4.1.60.Final CWE-444
TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

Priority MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20
TI-2021-09397 CVE-2021-28168 · GHSA-c43q-5hpj-4crv

Exposure of resource to wrong sphere in Eclipse Jersey

Priority LOW 29

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00869 Published 2021-04-22 Partial fix · 2.34, 3.0.2 CWE-378
TI-2021-09392 CVE-2021-28163 · GHSA-j6qj-j888-vvgq

Information disclosure in Eclipse Jetty

Priority LOW 21

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadverte…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.0418 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-200
TI-2021-13462 CVE-2021-34428 · GHSA-m6cp-vxjx-65j6

Insufficient session expiration in Eclipse Jetty

Priority LOW 19

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager.

CVSS 3.1LOW 3.5 Physical No auth No interaction EPSS 0.00963 Published 2021-06-22 Partial fix · 9.4.41, 10.0.3 +1 CWE-613