Read the docs
Red Hat Security Advisory

RHSA-2022:1013

Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update

Released 2022-03-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 14 records

TI-2021-18806 CVE-2021-42392 · GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

Priority HIGH 83

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83176 Published 2022-01-07 Partial fix · 2.0.206 CWE-502
TI-2021-05523 CVE-2021-22569 · GHSA-wrvw-hg22-4m67

Denial of Service of protobuf-java parsing procedure

Priority HIGH 72

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01795 Published 2022-01-07 Partial fix · 3.16.1, 3.18.2 +1 CWE-696
TI-2021-08126 CVE-2021-26291 · GHSA-2f88-5hg8-9x2x

block repositories using http by default

Priority MEDIUM 51

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.08691 Published 2021-04-23 Partial fix · 3.8.1 CWE-346
TI-2021-18101 CVE-2021-41269 · GHSA-p9m8-27x8-rg87

Unauthenticated remote code injection in cron-utils

Priority MEDIUM 50

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.04349 Published 2021-11-15 Partial fix · 9.1.6 CWE-94
TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-02132 CVE-2021-2471 · GHSA-w6f2-8wx4-47r5

Incorrect authorization in Oracle MySQL Connectors

Priority LOW 37

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.07493 Published 2021-10-20 Partial fix · 8.0.27 CWE-863
TI-2021-10677 CVE-2021-30129 · GHSA-9279-7hph-r3xw

DoS/OOM leak vulnerability in Apache Mina SSHD Server

Priority LOW 34

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03049 Published 2021-07-12 Partial fix · 2.7.0 CWE-772
TI-2021-03045 CVE-2021-4178 · GHSA-98g7-rxmf-rrxm

Deserialization of untrusted data in kubernetes-client

Priority LOW 30

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00335 Published 2022-08-24 Partial fix · 5.0.3, 5.1.2 +5 CWE-502
TI-2020-12221 CVE-2020-15522 · GHSA-6xx3-rg99-gc3p

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2…

Priority LOW 30

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01522 Published 2021-05-20 Partial fix · 1.0.2.1, 1.66 +1 CWE-362
TI-2021-09397 CVE-2021-28168 · GHSA-c43q-5hpj-4crv

Exposure of resource to wrong sphere in Eclipse Jersey

Priority LOW 29

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00869 Published 2021-04-22 Partial fix · 2.34, 3.0.2 CWE-378
TI-2020-07155 CVE-2020-8908 · GHSA-5mg8-w23w-74h3

Temp directory permission issue in Guava

Priority LOW 18

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.F…

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00924 Published 2020-12-10 Partial fix · 32.0, 32.0.0-android CWE-378