Red Hat Security Advisory

RHSA-2022:0296

Red Hat Process Automation Manager 7.12.0 security update

Released 2022-01-26 · Red Hat rating Critical · View on Red Hat →

Fixed in

RHPAM 7.12.0

Fixes 18 records

TI-2021-19919 CVE-2021-44228 · GHSA-jfh8-c2jp-5v3q

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

CRITICAL 100KEV

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other J…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99999 Published 2021-12-10 Partial fix · 2.15.0, 2.3.1 +5 CWE-20

TI-2021-16530 CVE-2021-39144 · GHSA-j9h8-phrw-h4fh

XStream is vulnerable to a Remote Command Execution attack

CRITICAL 96KEV

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.98124 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-10213 CVE-2021-29505 · GHSA-7chv-rrw6-w6fc

XStream is vulnerable to a Remote Command Execution attack

HIGH 79

XStream is software for serializing Java objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77232 Published 2021-05-28 Partial fix · 1.4.17 CWE-502

TI-2021-16528 CVE-2021-39141 · GHSA-g5w6-mrj7-75h2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 61

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.16118 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16532 CVE-2021-39146 · GHSA-p8pq-r894-fm8f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 60

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.143 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16538 CVE-2021-39152 · GHSA-xw4p-crpj-vjx2

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

MEDIUM 56

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.11377 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16526 CVE-2021-39139 · GHSA-64xx-cq4q-mf44

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 53

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0454 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16540 CVE-2021-39154 · GHSA-6w62-hx7r-mw68

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16539 CVE-2021-39153 · GHSA-2q8x-2p7f-574v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04457 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16537 CVE-2021-39151 · GHSA-hph2-m3g5-xxv4

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16535 CVE-2021-39149 · GHSA-3ccq-5vw3-2p6x

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16534 CVE-2021-39148 · GHSA-qrx8-8545-4wg2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16533 CVE-2021-39147 · GHSA-h7v4-7xg3-hxcc

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16531 CVE-2021-39145 · GHSA-8jrj-525p-826v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04065 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16536 CVE-2021-39150 · GHSA-cxfm-5m4g-x7xp

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

MEDIUM 51

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.03437 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16527 CVE-2021-39140 · GHSA-6wf9-jmg9-vxcc

XStream can cause a Denial of Service

MEDIUM 44

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05918 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2020-17296 CVE-2020-28491 · GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

LOW 37

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02417 Published 2021-02-18 Partial fix · 2.11.4, 2.12.1 CWE-770

TI-2021-03514 CVE-2021-20218 · GHSA-jwh2-ffg4-48xc

Path traversal in fabric8-kubernetes-client

LOW 35

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01312 Published 2021-03-16 Partial fix · 4.7.2, 4.11.2 +2 CWE-22