RHSA-2022:6835

pgjdbc is the offical PostgreSQL JDBC Driver.

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them.

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

A flaw was found in Quarkus.

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

graphql-java before19.0 is vulnerable to Denial of Service.

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Prism is a syntax highlighting library.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.