Red Hat Security Advisory

RHSA-2022:8902

Red Hat Camel for Spring Boot 3.18.3 release and security update

Released 2022-12-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHINT Camel-Springboot 3.18.3

Fixes 3 records

TI-2022-20885 CVE-2022-42889 · GHSA-599f-7c49-w659

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

CRITICAL 94

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99931 Published 2022-10-13 Partial fix · 1.10.0 CWE-94

TI-2022-09453 CVE-2022-25897 · GHSA-fph9-f5r6-vhqf

Denial of service (DoS) in org.eclipse.milo:sdk-server

LOW 35

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubs…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01305 Published 2022-09-08 Partial fix · 0.6.8 CWE-770

TI-2022-13603 CVE-2022-31684 · GHSA-7w4x-4h67-pgmv

Sensitive information in log files in Reactor Netty

LOW 21

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00771 Published 2022-10-19 Partial fix · 1.0.24 CWE-532