Red Hat Security AdvisoryRHSA-2024:3527
Red Hat AMQ Streams 2.7.0 release and security update
Released 2024-05-30 · Red Hat rating Moderate · View on Red Hat →
Fixes 17 records
Priority CRITICAL 94
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99931 · Published 2022-10-13 · Partial fix · 1.10.0 CWE-94
Priority HIGH 72
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01211 · Published 2023-09-25 · Partial fix · 1.1.10.4 CWE-770
Priority HIGH 72
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01119 · Published 2023-03-13 · Partial fix · 2.4.9 CWE-674
Priority MEDIUM 63
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0138 · Published 2024-03-25 · Partial fix · 4.1.108.Final CWE-770
Priority MEDIUM 62
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01653 · Published 2024-03-27 · Partial fix · 2.4.0-7, 2.4.0-4 +5 CWE-401
Priority MEDIUM 55
There's a flaw in lz4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03401 · Published 2021-06-02 · Partial fix CWE-190
Priority MEDIUM 48
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03501 · Published 2022-11-07 · Partial fix · 6.6.0 CWE-787
Priority MEDIUM 42
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01588 · Published 2023-03-31 · Partial fix · 1.5.4, 1.5.4.0 CWE-400
Priority LOW 36
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
CVSS 3.1HIGH 8.1· Local · No auth · No interaction · EPSS 0.00441 · Published 2024-02-19 · Partial fix · 1.26.0 CWE-835
Priority LOW 35
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01278 · Published 2022-10-12 · Fixed in 3.21.7, 3.20.3 +2 CWE-20
Priority LOW 33
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00248 · Published 2023-06-14 · Partial fix · 32.0.0, 32.0.0-android CWE-552
Priority LOW 31
A vulnerability was found in the quarkus-core component.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00309 · Published 2024-04-04 · Partial fix · 3.2.12.Final-redhat-00001, 3.8.4.redhat-00002 +8 CWE-526
Priority LOW 27
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.01064 · Published 2024-04-02 · Partial fix · 2.4.0-7, 2.4.0-4 +9 CWE-772
Priority LOW 27
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00998 · Published 2023-11-23 · Partial fix · 1.73 CWE-400
Priority LOW 25
json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00676 · Published 2023-12-27 · Partial fix · 2.9.0 CWE-787
Priority LOW 25
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00772 · Published 2023-07-05 · Partial fix · 1.74 CWE-295
Priority LOW 22
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwar…
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.00348 · Published 2021-03-04 · Partial fix · 1.4.9 CWE-277
THREATIST.IORead the docs