Red Hat Security AdvisoryRHSA-2022:2232
Red Hat Data Grid 8.3.1 security update
Released 2022-05-12 · Red Hat rating Moderate · View on Red Hat →
Fixes 3 records
Priority MEDIUM 47
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0486 · Published 2022-03-11 · Partial fix · 2.13.2.1, 2.12.6.1 CWE-787
Priority LOW 36
A flaw was found in XNIO, specifically in the notifyReadClosed method.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01583 · Published 2022-08-26 · Partial fix CWE-770
Priority LOW 36
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06201 · Published 2021-09-22 · Partial fix · 2.6.3, 2.7.2 +1 CWE-203
