Red Hat Security Advisory

RHSA-2021:4918

Red Hat Integration Camel-K 1.6 release and security update

Released 2021-12-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Integration

Fixes 32 records

TI-2021-16530 CVE-2021-39144 · GHSA-j9h8-phrw-h4fh

XStream is vulnerable to a Remote Command Execution attack

CRITICAL 96KEV

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.98124 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-04451 CVE-2021-21351 · GHSA-hrcp-8f3q-4w2c

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.82136 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04446 CVE-2021-21346 · GHSA-4hrm-m67v-5cxr

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76367 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04444 CVE-2021-21344 · GHSA-59jw-jqf4-3wq3

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7598 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04445 CVE-2021-21345 · GHSA-hwpc-8xqv-jvj4

XStream is vulnerable to a Remote Command Execution attack

HIGH 81

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.72324 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-10213 CVE-2021-29505 · GHSA-7chv-rrw6-w6fc

XStream is vulnerable to a Remote Command Execution attack

HIGH 79

XStream is software for serializing Java objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77232 Published 2021-05-28 Partial fix · 1.4.17 CWE-502

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04450 CVE-2021-21350 · GHSA-43gc-mjxg-gvrq

XStream is vulnerable to an Arbitrary Code Execution attack

HIGH 65

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15234 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04447 CVE-2021-21347 · GHSA-qpfq-ph7r-qv6f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 64

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14301 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-16528 CVE-2021-39141 · GHSA-g5w6-mrj7-75h2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 61

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.16118 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16532 CVE-2021-39146 · GHSA-p8pq-r894-fm8f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 60

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.143 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2020-10913 CVE-2020-13936 · GHSA-59j4-wjwp-mw9m

Velocity Sandbox Bypass

MEDIUM 58

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22709 Published 2021-03-10 Partial fix · 2.3 CWE-20

TI-2021-16538 CVE-2021-39152 · GHSA-xw4p-crpj-vjx2

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

MEDIUM 56

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.11377 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-04448 CVE-2021-21348 · GHSA-56p8-3fh9-4cvq

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

MEDIUM 54

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13832 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-16526 CVE-2021-39139 · GHSA-64xx-cq4q-mf44

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 53

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0454 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16540 CVE-2021-39154 · GHSA-6w62-hx7r-mw68

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16539 CVE-2021-39153 · GHSA-2q8x-2p7f-574v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04457 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16537 CVE-2021-39151 · GHSA-hph2-m3g5-xxv4

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16535 CVE-2021-39149 · GHSA-3ccq-5vw3-2p6x

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16534 CVE-2021-39148 · GHSA-qrx8-8545-4wg2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16533 CVE-2021-39147 · GHSA-h7v4-7xg3-hxcc

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16531 CVE-2021-39145 · GHSA-8jrj-525p-826v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04065 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16536 CVE-2021-39150 · GHSA-cxfm-5m4g-x7xp

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

MEDIUM 51

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.03437 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16527 CVE-2021-39140 · GHSA-6wf9-jmg9-vxcc

XStream can cause a Denial of Service

MEDIUM 44

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05918 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-09022 CVE-2021-27568 · GHSA-v528-7hrm-frqp

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2…

LOW 38

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02886 Published 2021-02-23 Partial fix · 1.3.2, 2.4.1 +1 CWE-754

TI-2020-17296 CVE-2020-28491 · GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

LOW 37

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02417 Published 2021-02-18 Partial fix · 2.11.4, 2.12.1 CWE-770

TI-2020-11197 CVE-2020-14326 · GHSA-37g7-8vjj-pjpj

Uncontrolled resource consumption in RESTEasy

LOW 35

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01246 Published 2021-06-02 Partial fix · 4.5.6.Final CWE-400

TI-2021-05110 CVE-2021-22118 · GHSA-gfwj-fwqj-fp3v

Improper privilege management in Spring Framework

LOW 34

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticat…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00381 Published 2021-05-27 Partial fix · 5.2.15, 5.3.7 CWE-269

TI-2021-03616 CVE-2021-20328 · GHSA-rghw-6px2-fgwc

MongoDB Java driver client-side field level encryption not verifying KMS host name

LOW 32

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate.

CVSS 3.1MEDIUM 6.8 Adjacent network No auth No interaction EPSS 0.00436 Published 2021-02-25 Partial fix · 3.11.3, 3.12.8 +3 CWE-295

TI-2021-11809 CVE-2021-31812 · GHSA-7grw-6pjh-jpc9

A carefully crafted PDF file can trigger an infinite loop while loading the file

LOW 30

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03054 Published 2021-06-12 Partial fix · 2.0.24 CWE-834