Read the docs
Red Hat Security Advisory

RHSA-2023:4612

Red Hat support for Spring Boot 2.7.13 security update

Released 2023-08-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2022-01345 CVE-2022-1471 · GHSA-mjmj-j48q-9wg2

Remote Code execution in SnakeYAML

Priority CRITICAL 88

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99501 Published 2022-12-01 Partial fix · 2.0 CWE-20
TI-2023-07279 CVE-2023-20860 · GHSA-7phw-cxx7-q9vq

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern…

Priority MEDIUM 45

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spri…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03514 Published 2023-03-27 Partial fix · 6.0.7, 5.3.26
TI-2022-22218 CVE-2022-45143 · GHSA-rq2w-37h9-vg94

Apache Tomcat: JsonErrorReportValve escaping

Priority LOW 38

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02669 Published 2023-01-03 Partial fix · 8.5.84, 9.0.69 +1 CWE-116
TI-2021-21545 CVE-2021-46877 · GHSA-3x8x-79m2-3w2w

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows…

Priority LOW 35

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01124 Published 2023-03-18 Partial fix · 2.12.6, 2.13.1 CWE-770
TI-2023-07280 CVE-2023-20861 · GHSA-564r-hj7v-mcr5

Uncontrolled resource consumption in Spring Framework

Priority LOW 31

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0097 Published 2023-03-23 Partial fix · 6.0.7, 5.3.26 +1 CWE-400
TI-2022-13603 CVE-2022-31684 · GHSA-7w4x-4h67-pgmv

Sensitive information in log files in Reactor Netty

Priority LOW 21

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00771 Published 2022-10-19 Partial fix · 1.0.24 CWE-532