Red Hat Security AdvisoryRHSA-2022:5903
Red Hat Process Automation Manager 7.13.0 security update
Released 2022-08-04 · Red Hat rating Moderate · View on Red Hat →
Fixes 12 records
Priority HIGH 72
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01795 · Published 2022-01-07 · Partial fix · 3.16.1, 3.18.2 +1 CWE-696
Priority MEDIUM 61
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.36909 · Published 2022-04-01 · Partial fix · 5.3.17, 5.2.20.RELEASE CWE-770
Priority MEDIUM 50
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.1223 · Published 2022-05-01 · Partial fix · 2.8.9 CWE-502
Priority MEDIUM 48
jsoup is a Java library for working with HTML.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06689 · Published 2021-08-18 · Partial fix · 1.14.2 CWE-248
Priority MEDIUM 48
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06565 · Published 2021-10-19 · Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
Priority MEDIUM 48
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05908 · Published 2021-10-19 · Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
Priority LOW 37
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).
CVSS 3.1MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.07493 · Published 2021-10-20 · Partial fix · 8.0.27 CWE-863
Priority LOW 34
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02884 · Published 2021-12-09 · Partial fix · 4.1.71.Final CWE-444
Priority LOW 34
A flaw was found in Wildfly.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00315 · Published 2022-05-24 · Partial fix · 17.0 CWE-552
Priority LOW 30
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02532 · Published 2021-07-14 · Partial fix · Apache Ant, 1.9.16 +1 CWE-130
Priority LOW 26
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2021-08-05 · Partial fix · 1.10.14, 1.15.5 +1 CWE-203
Priority LOW 18
A flaw was found in wildfly-core in all versions.
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00982 · Published 2022-08-26 · Partial fix · 16.0.1.Final, 17.0.0.Beta3 CWE-200
THREATIST.IORead the docs