Read the docs
Red Hat Security Advisory

RHSA-2023:3815

Service Registry (container images) release and security update [2.4.3 GA]

Released 2023-06-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 9 records

TI-2022-19041 CVE-2022-40152 · GHSA-3f7h-mf4q-vrm4

Stack Buffer Overflow in Woodstox

Priority HIGH 66

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18215 Published 2022-09-16 Partial fix · 6.4.0, 5.4.0 CWE-121
TI-2022-03468 CVE-2022-3782 · GHSA-g8q8-fggx-9r3q

Path traversal in Red Hat Keycloak

Priority MEDIUM 56

keycloak: path traversal via double URL encoding.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05953 Published 2023-01-11 Partial fix · 20.0.2 CWE-22
TI-2022-04338 CVE-2022-4742 · GHSA-6xrf-q977-5vgc

json-pointer index.js set prototype pollution

Priority MEDIUM 44

A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01099 Published 2022-12-26 Partial fix · 0.6.2 CWE-1321
TI-2022-03237 CVE-2022-3509 · GHSA-g5ww-5jh7-63cx

Parsing issue in protobuf textformat

Priority MEDIUM 41

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00967 Published 2022-11-01 Partial fix · 3.21.7, 3.20.3 +2 CWE-400
TI-2022-03238 CVE-2022-3510 · GHSA-4gg5-vx3j-xwc7

Parsing issue in protobuf message-type extension

Priority MEDIUM 40

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00717 Published 2022-11-11 Partial fix · 3.21.7, 3.20.3 +2 CWE-400
TI-2021-21545 CVE-2021-46877 · GHSA-3x8x-79m2-3w2w

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows…

Priority LOW 35

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01124 Published 2023-03-18 Partial fix · 2.12.6, 2.13.1 CWE-770