Red Hat Security Advisory

RHSA-2023:0471

Migration Toolkit for Runtimes security update

Released 2023-01-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Migration Toolkit for Runtimes 1 on RHEL 8

Fixes 6 records

TI-2022-20909 CVE-2022-42920 · GHSA-97xg-phpr-rg8q

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

MEDIUM 48

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03501 Published 2022-11-07 Partial fix · 6.6.0 CWE-787

TI-2022-09465 CVE-2022-25914 · GHSA-936v-cg49-m2g5

Remote code execution (RCE) in com.google.cloud.tools:jib-core

MEDIUM 46

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01752 Published 2022-09-08 Partial fix · 0.22.0

TI-2022-20343 CVE-2022-42004 · GHSA-rgv9-q543-rqg4

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a…

MEDIUM 45

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4 CWE-502

TI-2022-17517 CVE-2022-37603 · GHSA-3rfm-jhwj-7488

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName…

MEDIUM 44

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02702 Published 2022-10-14 Partial fix · 1.4.2, 2.0.4 +1 CWE-1333

TI-2022-03245 CVE-2022-3517 · GHSA-f8q6-p94x-37v3

Uncontrolled resource consumption in minimatch

MEDIUM 43

A vulnerability was found in the minimatch package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02279 Published 2022-10-17 Partial fix · 3.0.5 CWE-400

TI-2022-20342 CVE-2022-42003 · GHSA-jjjh-jjxp-wpff

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion…

LOW 39

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4.2 CWE-502