Red Hat Security AdvisoryRHSA-2022:8761
Red Hat support for Spring Boot 2.7.2 update
Released 2022-12-14 · Red Hat rating Moderate · View on Red Hat →
Fixes 6 records
Priority HIGH 72
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01795 · Published 2022-01-07 · Partial fix · 3.16.1, 3.18.2 +1 CWE-696
Priority MEDIUM 61
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.36909 · Published 2022-04-01 · Partial fix · 5.3.17, 5.2.20.RELEASE CWE-770
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01696 · Published 2022-08-31 · Partial fix CWE-252
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01392 · Published 2022-08-31 · Partial fix CWE-400
Priority LOW 30
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00335 · Published 2022-08-24 · Partial fix · 5.0.3, 5.1.2 +5 CWE-502
Priority LOW 27
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00659 · Published 2020-03-03 · Fixed in v0.8.16.RELEASE, v0.9.5.RELEASE +2 CWE-522
THREATIST.IORead the docs