RHSA-2023:1516

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.

Netty project is an event-driven asynchronous network application framework.

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack.

The undertow client is not checking the server identity presented by the server certificate in https connections.

A flaw was found in undertow.

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.