Red Hat Security Advisory

RHSA-2023:5441

Red Hat Integration Camel for Spring Boot 4.0.0 release and security update

Released 2023-10-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHINT Camel-Springboot 4.0.0

Fixes 8 records

TI-2022-23117 CVE-2022-46751 · GHSA-2jc4-r94c-rp7h

Apache Ivy: XML External Entity vulnerability in Apache Ivy

MEDIUM 46

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01999 Published 2023-08-21 Partial fix · 2.5.2 CWE-611

TI-2023-11282 CVE-2023-26048 · GHSA-qw69-rqj8-6qw8

OutOfMemoryError for large multipart without filename in Eclipse Jetty

LOW 36

Jetty is a java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03369 Published 2023-04-18 Partial fix · 9.4.51, 10.0.14 +2 CWE-400

TI-2023-17287 CVE-2023-34462 · GHSA-6mjq-h674-j845

netty-handler SniHandler 16MB allocation

LOW 34

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02459 Published 2023-06-22 Partial fix · 4.1.94.Final CWE-400

TI-2023-21041 CVE-2023-40167 · GHSA-hmr7-m48g-48f6

Jetty accepts "+" prefixed value in Content-Length

LOW 33

Jetty is a Java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01279 Published 2023-09-15 Partial fix · 9.4.52, 10.0.16 +2 CWE-130

TI-2023-16196 CVE-2023-33008 · GHSA-crqg-jrpj-fc84

Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

LOW 33

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01442 Published 2023-07-07 Partial fix · 1.2.21 CWE-502

TI-2022-22018 CVE-2022-44729 · GHSA-gq5f-xv48-2365

Apache XML Graphics Batik: Information disclosure vulnerability

LOW 33

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00919 Published 2023-08-22 Partial fix · 1.17 CWE-918

TI-2023-11283 CVE-2023-26049 · GHSA-p26g-97m4-6q7c

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

LOW 27

Jetty is a java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.013 Published 2023-04-18 Partial fix · 9.4.51, 10.0.14 +3 CWE-200

TI-2022-22019 CVE-2022-44730 · GHSA-2474-2566-3qxp

Apache XML Graphics Batik: Information disclosure vulnerability

LOW 22

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00816 Published 2023-08-22 Partial fix · 1.17 CWE-918