Read the docs
Red Hat Security Advisory

RHSA-2024:1353

Red Hat Process Automation Manager 7.13.5 security update

Released 2024-03-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2022-01345 CVE-2022-1471 · GHSA-mjmj-j48q-9wg2

Remote Code execution in SnakeYAML

Priority CRITICAL 88

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99501 Published 2022-12-01 Partial fix · 2.0 CWE-20
TI-2022-20306 CVE-2022-41966 · GHSA-j563-grx4-pjpv

XStream Denial of Service via stack overflow

Priority HIGH 75

XStream serializes Java objects to XML and back again.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.09347 Published 2022-12-27 Partial fix · 1.4.20 CWE-120
TI-2022-19040 CVE-2022-40151 · GHSA-f8cc-g7j8-xxpm

Stack Buffer Overflow in xstream

Priority HIGH 66

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02222 Published 2022-09-16 Partial fix · 1.4.20 CWE-121
TI-2023-04667 CVE-2023-5072 · GHSA-4jq9-2xhw-jpx7

DoS Vulnerability in JSON-Java

Priority MEDIUM 42

Denial of Service in JSON-Java versions up to and including 20230618.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01741 Published 2023-10-12 Partial fix · 20231013 CWE-770
TI-2023-03393 CVE-2023-3635 · GHSA-w33c-445m-f8w7

Okio GzipSource unhandled exception Denial of Service

Priority LOW 35

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2023-07-12 Partial fix · 1.17.6, 3.4.0 CWE-195
TI-2023-05939 CVE-2023-6481 · GHSA-gm62-rw4g-vrc4

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

Priority LOW 34

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00682 Published 2023-12-04 Partial fix · 1.4.14, 1.3.14 +1
TI-2022-22018 CVE-2022-44729 · GHSA-gq5f-xv48-2365

Apache XML Graphics Batik: Information disclosure vulnerability

Priority LOW 33

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00919 Published 2023-08-22 Partial fix · 1.17 CWE-918
TI-2023-06139 CVE-2023-6717 · GHSA-8rmm-gm28-pj8q

Keycloak: xss via assertion consumer service url in saml post-binding flow

Priority LOW 30

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (X…

CVSS 3.1MEDIUM 6.0 Network High privileges User interaction EPSS 0.00711 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +5 CWE-79
TI-2023-00456 CVE-2023-0482 · GHSA-2c6g-pfx3-w7h8

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider…

Priority LOW 24

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00261 Published 2023-02-17 Partial fix · 6.2.3.Final, 5.0.6.Final +2 CWE-378
TI-2022-22019 CVE-2022-44730 · GHSA-2474-2566-3qxp

Apache XML Graphics Batik: Information disclosure vulnerability

Priority LOW 22

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00816 Published 2023-08-22 Partial fix · 1.17 CWE-918