Red Hat Security Advisory

RHSA-2022:1179

Red Hat support for Spring Boot 2.5.10 update

Released 2022-04-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Support for Spring Boot 2.5.10

Fixes 9 records

TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444

TI-2021-17922 CVE-2021-41079 · GHSA-59g9-7gfx-c72p

Apache Tomcat DoS with unexpected TLS packet

MEDIUM 49

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07182 Published 2021-09-16 Partial fix · 10.0.4, 9.0.44 +1 CWE-20

TI-2021-11031 CVE-2021-30640 · GHSA-36qh-35cm-5w2w

Auth weakness in JNDIRealm

MEDIUM 47

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.09886 Published 2021-07-12 Partial fix · 10.0.5, 9.0.45 +1 CWE-116

TI-2021-18769 CVE-2021-42340 · GHSA-wph7-x527-w3h5

DoS via memory leak with WebSocket connections

MEDIUM 46

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11796 Published 2021-10-14 Partial fix · 10.1.0-M6, 10.0.12 +2 CWE-772

TI-2021-02790 CVE-2021-3859 · GHSA-339q-62wm-c39w

Exposure of resource to wrong sphere in undertow

LOW 36

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01736 Published 2022-08-26 Partial fix · 2.2.15 CWE-214

TI-2021-02574 CVE-2021-3629 · GHSA-rf6q-vx79-mjxr

Uncontrolled resource consumption in undertow

LOW 29

A flaw was found in Undertow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01322 Published 2022-05-24 Partial fix · 2.0.40.Final, 2.2.11.Final CWE-400

TI-2021-02544 CVE-2021-3597 · GHSA-mfhv-gwf8-4m88

Race condition in undertow

LOW 29

A flaw was found in undertow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01161 Published 2022-05-24 Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362

TI-2021-03579 CVE-2021-20289 · GHSA-244r-fcj3-ghjq

Information disclosure through error messages in resteasy

LOW 27

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.014 Published 2021-03-26 Partial fix · 4.6.1, 4.5.10 +1 CWE-209

TI-2021-02587 CVE-2021-3642 · GHSA-5499-qjvh-6j7w

Observable discrepancy in wildfly-elytron

LOW 26

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00846 Published 2021-08-05 Partial fix · 1.10.14, 1.15.5 +1 CWE-203