Read the docs
Red Hat Security Advisory

RHSA-2023:7247

Red Hat Fuse 7.12.1 release and security update

Released 2023-11-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 13 records

TI-2023-25106 CVE-2023-46604 · GHSA-crg9-44h2-xw35

Deserialization of untrusted data in Apache ActiveMQ

Priority CRITICAL 100KEV

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99992 Published 2023-10-27 Partial fix · 5.18.3, 5.17.6 +2 CWE-502
TI-2023-16900 CVE-2023-34034 · GHSA-3h6f-g5f3-gc4w

Improper access control in Spring Security

Priority MEDIUM 56

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04074 Published 2023-07-19 Partial fix · 5.6.12, 5.7.10 +3 CWE-281
TI-2023-24449 CVE-2023-45648 · GHSA-r6j3-px5g-cq3x

Apache Tomcat: Trailer header parsing too lenient

Priority LOW 39

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05883 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-20
TI-2023-22886 CVE-2023-42795 · GHSA-g8pj-r55q-5c2v

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

Priority LOW 35

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 th…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02515 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-459
TI-2023-03393 CVE-2023-3635 · GHSA-w33c-445m-f8w7

Okio GzipSource unhandled exception Denial of Service

Priority LOW 35

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2023-07-12 Partial fix · 1.17.6, 3.4.0 CWE-195
TI-2023-18320 CVE-2023-36479 · GHSA-3gh6-v5v9-6v9j

Jetty vulnerable to errant command quoting in CGI Servlet

Priority LOW 19

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.01162 Published 2023-09-15 Partial fix · 9.4.52, 10.0.16 +2 CWE-149