Red Hat Security AdvisoryRHSA-2024:3354
Red Hat Fuse 7.13.0 release and security update
Released 2024-05-23 · Red Hat rating Important · View on Red Hat →
Fixes 18 records
Priority HIGH 80
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.85694 · Published 2023-11-28 · Partial fix · 5.16.6, 5.17.4 +2 CWE-287
Priority HIGH 66
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.68446 · Published 2024-01-15 · Fixed in 9.3.0 CWE-200
Priority MEDIUM 47
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.02925 · Published 2024-03-15 · Partial fix · 4.0.4, 3.6.3 +1 CWE-918
Priority MEDIUM 44
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.03967 · Published 2024-02-23 · Partial fix · 6.0.17, 6.1.4 +1 CWE-601
Priority MEDIUM 44
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP t…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02651 · Published 2023-11-28 · Partial fix · 11.0.0-M11, 10.1.16 +2 CWE-444
Priority MEDIUM 44
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02659 · Published 2023-09-27 · Partial fix · 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap +6 CWE-789
Priority MEDIUM 43
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken acce…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00956 · Published 2024-03-18 · Partial fix · 5.7.12, 5.8.11 +2 CWE-862
Priority MEDIUM 43
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02221 · Published 2023-09-29 · Partial fix · 1.11.3 CWE-502
Priority MEDIUM 42
Denial of Service in JSON-Java versions up to and including 20230618.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01741 · Published 2023-10-12 · Partial fix · 20231013 CWE-770
Priority MEDIUM 41
Eclipse Jetty provides a web server and servlet container.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04832 · Published 2023-10-10 · Partial fix · 10.0.16, 11.0.16 +1 CWE-190
Priority MEDIUM 40
A vulnerability was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04572 · Published 2024-02-19 · Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400
Priority LOW 39
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.14286 · Published 2024-01-19 · Fixed in 9.0.44, 8.5.64 CWE-209
Priority LOW 35
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.009 · Published 2023-11-29 · Partial fix · 1.4.12, 1.3.12 +1 CWE-502
Priority LOW 34
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00682 · Published 2023-12-04 · Partial fix · 1.4.14, 1.3.14 +1
Priority LOW 33
Jetty is a Java based web server and servlet engine.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01279 · Published 2023-09-15 · Partial fix · 9.4.52, 10.0.16 +2 CWE-130
Priority LOW 31
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01187 · Published 2024-01-15 · Partial fix · 1.13.0, 2.0.0-alpha-4 +1 CWE-22
Priority LOW 31
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01219 · Published 2023-11-28 · Partial fix · 2.7.18, 3.0.13 +1
Priority LOW 19
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project.
CVSS 3.1LOW 3.5· Network · Low privileges · No interaction · EPSS 0.01162 · Published 2023-09-15 · Partial fix · 9.4.52, 10.0.16 +2 CWE-149
THREATIST.IORead the docs