Red Hat Security Advisory

RHSA-2023:1286

Migration Toolkit for Runtimes security bug fix and enhancement update

Released 2023-03-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8

Fixes 3 records

TI-2022-20306 CVE-2022-41966 · GHSA-j563-grx4-pjpv

XStream Denial of Service via stack overflow

HIGH 75

XStream serializes Java objects to XML and back again.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.09347 Published 2022-12-27 Partial fix · 1.4.20 CWE-120

TI-2022-22907 CVE-2022-46364 · GHSA-x3x3-qwjq-8gj4

Apache CXF SSRF Vulnerability

MEDIUM 53

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02315 Published 2022-12-13 Partial fix · 3.5.5, 3.4.10 CWE-918

TI-2022-13609 CVE-2022-31690 · GHSA-32vj-v39g-jh23

Improper privilege management in Spring Security

MEDIUM 40

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0125 Published 2022-10-31 Partial fix · 5.7.5, 5.6.9 CWE-269