Red Hat Security Advisory

RHSA-2024:2833

Service Registry (container images) release and security update [2.5.11 GA]

Released 2024-05-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHINT Service Registry 2.5.11 GA

Fixes 5 records

TI-2024-19207 CVE-2024-29025 · GHSA-5jpm-x58v-624v

Netty HttpPostRequestDecoder can OOM

MEDIUM 63

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0138 Published 2024-03-25 Partial fix · 4.1.108.Final CWE-770

TI-2024-00946 CVE-2024-1023 · GHSA-5667-3wch-7q7w

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

MEDIUM 62

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01653 Published 2024-03-27 Partial fix · 2.4.0-7, 2.4.0-4 +5 CWE-401

TI-2024-16916 CVE-2024-25710 · GHSA-4g9r-vxhx-9pgx

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

LOW 36

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

CVSS 3.1HIGH 8.1 Local No auth No interaction EPSS 0.00441 Published 2024-02-19 Partial fix · 1.26.0 CWE-835

TI-2024-17389 CVE-2024-26308 · GHSA-4265-ccf5-phj5

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

LOW 27

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00898 Published 2024-02-19 Partial fix · 1.26.0 CWE-770

TI-2024-01210 CVE-2024-1300 · GHSA-9ph3-v2vh-3qx7

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

LOW 27

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01064 Published 2024-04-02 Partial fix · 2.4.0-7, 2.4.0-4 +9 CWE-772