Read the docs
Red Hat Security Advisory

RHSA-2021:4767

Red Hat Integration Camel Extensions for Quarkus GA security update

Released 2021-11-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 47 records

TI-2020-16038 CVE-2020-26217 · GHSA-mw36-7c6c-q4q2

Remote Code Execution in XStream

Priority CRITICAL 87

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84968 Published 2020-11-16 Partial fix · 1.4.14, 1.4.14-java7 CWE-78
TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

Priority HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-09394 CVE-2021-28165 · GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

Priority HIGH 71

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53861 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-400
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-09393 CVE-2021-28164 · GHSA-v7ff-8wcx-gmc5

Information disclosure in Eclipse Jetty

Priority HIGH 65

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.82371 Published 2021-04-01 Partial fix · 9.4.39 CWE-200
TI-2021-09398 CVE-2021-28169 · GHSA-gwcr-j4wh-j3cq

Information disclosure in Eclipse Jetty

Priority MEDIUM 64

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.7848 Published 2021-06-09 Partial fix · 9.4.41, 10.0.3 +1 CWE-200
TI-2020-16549 CVE-2020-27223 · GHSA-m394-8rww-3jr7

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 64

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.78031 Published 2021-02-26 Partial fix · 9.4.37, 10.0.1 +1 CWE-407
TI-2020-10913 CVE-2020-13936 · GHSA-59j4-wjwp-mw9m

Velocity Sandbox Bypass

Priority MEDIUM 58

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22709 Published 2021-03-10 Partial fix · 2.3 CWE-20
TI-2021-16527 CVE-2021-39140 · GHSA-6wf9-jmg9-vxcc

XStream can cause a Denial of Service

Priority MEDIUM 44

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05918 Published 2021-08-23 Partial fix · 1.4.18 CWE-502
TI-2020-11197 CVE-2020-14326 · GHSA-37g7-8vjj-pjpj

Uncontrolled resource consumption in RESTEasy

Priority LOW 35

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01246 Published 2021-06-02 Partial fix · 4.5.6.Final CWE-400
TI-2020-16544 CVE-2020-27218 · GHSA-86wm-rrjm-8wh8

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…

Priority LOW 33

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.08277 Published 2020-11-28 Partial fix · 9.4.35.v20201120 CWE-226
TI-2021-02587 CVE-2021-3642 · GHSA-5499-qjvh-6j7w

Observable discrepancy in wildfly-elytron

Priority LOW 26

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00846 Published 2021-08-05 Partial fix · 1.10.14, 1.15.5 +1 CWE-203
TI-2021-10142 CVE-2021-29429

Information disclosure through temporary directory permissions

Priority LOW 25

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00484 Published 2021-04-12 Partial fix · 7.0 CWE-377
TI-2021-09392 CVE-2021-28163 · GHSA-j6qj-j888-vvgq

Information disclosure in Eclipse Jetty

Priority LOW 21

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadverte…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.0418 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-200
TI-2021-13462 CVE-2021-34428 · GHSA-m6cp-vxjx-65j6

Insufficient session expiration in Eclipse Jetty

Priority LOW 19

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager.

CVSS 3.1LOW 3.5 Physical No auth No interaction EPSS 0.00963 Published 2021-06-22 Partial fix · 9.4.41, 10.0.3 +1 CWE-613