Headline
Red Hat Security Advisory 2023-3771-01
Red Hat Security Advisory 2023-3771-01 - The VDSM service is required by a Virtualization Manager to manage the Linux hosts. VDSM manages and monitors the host’s storage, memory and networks as well as virtual machine creation, other host administration tasks, statistics gathering, and log collection. Issues addressed include bypass, denial of service, and null pointer vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Virtualization security and bug fix update
Advisory ID: RHSA-2023:3771-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3771
Issue date: 2023-06-21
CVE Names: CVE-2023-20860 CVE-2023-20861
=====================================================================
- Summary:
An update is now available for Red Hat Virtualization 4 Tools for Red Hat
Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux
8, and Red Hat Virtualization Engine 4.4.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch
Red Hat Virtualization 4 Hypervisor for RHEL 8 - noarch, x86_64
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts - noarch, ppc64le, x86_64
- Description:
The VDSM service is required by a Virtualization Manager to manage the
Linux hosts. VDSM manages and monitors the host’s storage, memory and
networks as well as virtual machine creation, other host administration
tasks, statistics gathering, and log collection.
The following packages have been upgraded to a later upstream version:
ovirt-dependencies (4.5.3), ovirt-engine (4.5.3.8), vdsm (4.50.3.8).
(BZ#2180717)
Security Fix(es):
springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
(CVE-2023-20860)springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
Previously, a host with Secure Intel Icelake Server Family could become
non-operational because it did not provide the “taa-no” CPU feature.
In this release, the check has been fixed in the Manager, and such hosts
work properly. (BZ#2184623)Previously, when creating bonds on a host outside the Manager and adding
the host without starting it, the Rx\Tx drop count is shown as null.
As a result, a Null Pointer Exception is thrown in the Administration
Portal > Compute > Hosts > Network Interfaces tab.
With this release, null values are accepted, and there are no exceptions
displayed in the Network Interfaces tab. (BZ#2180230)Previously, the Volume Extend Logic method skipped sparse volumes. As a
result, RAW sparse volumes (on file storage) were not extended properly.
In this release, RAW sparse volumes are extended as expected. (BZ#2210036)
- Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/2974891
- Bugs fixed (https://bugzilla.redhat.com/):
2180230 - Network Interfaces is broken if tx_drop or rx_drop are empty in the DB
2180528 - CVE-2023-20860 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
2180530 - CVE-2023-20861 springframework: Spring Expression DoS Vulnerability
2184623 - [RHV] Host Non-Operation after update Cluster CPU to Secure Intel Icelake Server. Missing CPU feature: taa-no
2203132 - NullPointerException when creating a image transfer after a RHV-M reboot
2210036 - Extend of the raw sparse disk (thin provisioned without incremental backup) is ignored
- Package List:
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts:
Source:
vdsm-4.50.3.8-1.el8ev.src.rpm
noarch:
vdsm-api-4.50.3.8-1.el8ev.noarch.rpm
vdsm-client-4.50.3.8-1.el8ev.noarch.rpm
vdsm-common-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-cpuflags-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-ethtool-options-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-fcoe-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-localdisk-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-nestedvt-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-openstacknet-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-vhostmd-4.50.3.8-1.el8ev.noarch.rpm
vdsm-http-4.50.3.8-1.el8ev.noarch.rpm
vdsm-jsonrpc-4.50.3.8-1.el8ev.noarch.rpm
vdsm-python-4.50.3.8-1.el8ev.noarch.rpm
vdsm-yajsonrpc-4.50.3.8-1.el8ev.noarch.rpm
ppc64le:
vdsm-4.50.3.8-1.el8ev.ppc64le.rpm
vdsm-hook-checkips-4.50.3.8-1.el8ev.ppc64le.rpm
vdsm-hook-extra-ipv4-addrs-4.50.3.8-1.el8ev.ppc64le.rpm
vdsm-network-4.50.3.8-1.el8ev.ppc64le.rpm
x86_64:
vdsm-4.50.3.8-1.el8ev.x86_64.rpm
vdsm-gluster-4.50.3.8-1.el8ev.x86_64.rpm
vdsm-hook-checkips-4.50.3.8-1.el8ev.x86_64.rpm
vdsm-hook-extra-ipv4-addrs-4.50.3.8-1.el8ev.x86_64.rpm
vdsm-network-4.50.3.8-1.el8ev.x86_64.rpm
Red Hat Virtualization 4 Hypervisor for RHEL 8:
Source:
vdsm-4.50.3.8-1.el8ev.src.rpm
noarch:
vdsm-hook-cpuflags-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-ethtool-options-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-fcoe-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-localdisk-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-nestedvt-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-openstacknet-4.50.3.8-1.el8ev.noarch.rpm
vdsm-hook-vhostmd-4.50.3.8-1.el8ev.noarch.rpm
x86_64:
vdsm-hook-checkips-4.50.3.8-1.el8ev.x86_64.rpm
vdsm-hook-extra-ipv4-addrs-4.50.3.8-1.el8ev.x86_64.rpm
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source:
ovirt-dependencies-4.5.3-1.el8ev.src.rpm
ovirt-engine-4.5.3.8-2.el8ev.src.rpm
noarch:
ovirt-dependencies-4.5.3-1.el8ev.noarch.rpm
ovirt-engine-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-backend-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-dbscripts-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-health-check-bundler-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-restapi-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-base-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-cinderlib-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-imageio-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-common-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-setup-plugin-websocket-proxy-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-tools-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-tools-backup-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-vmconsole-proxy-helper-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-webadmin-portal-4.5.3.8-2.el8ev.noarch.rpm
ovirt-engine-websocket-proxy-4.5.3.8-2.el8ev.noarch.rpm
python3-ovirt-engine-lib-4.5.3.8-2.el8ev.noarch.rpm
rhvm-4.5.3.8-2.el8ev.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-20860
https://access.redhat.com/security/cve/CVE-2023-20861
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZJNw6tzjgjWX9erEAQh0DA//bldMneosPtyt2mmZt2cUEHTlWpFEQwcv
nkqQyxlnlzV8iKFEure302JQub2sYKvZKxnifxt4q2dRNe1mIBP0/Y57tVQ88yck
8nEZmTDUVEOAl92B1EKysRwnHrRfH9IRwtPNFvuB+11DK5veFKjFbMKDTw5R8znu
Ec1EN9Cw40uo0uPZ2hsv4zpDLITOslteIvJUGmiAsqyi01R+vEeBKV8Wsc3eA6s+
OvmMYHv4Qd1ikWcZZnEISpYJk2iLMyAbUUd1OREf80gS2YuEqZOIGeOZsbkL6blV
ZM8uXFp4cpjL07QbAM/6OxFg0ApRrJ3WaK63Zual9MCx0rsKXJZrdrOMt30qhbT5
I1aYUjoL3N0TzyyxantP6aqUSTOeTHwjJhCcmIK+TZpKJ0H3vsmhL2CNsC8zs1MG
PrJDHqgbllsXWGo82W6tE5yPWf4MUeveGkVLbC+6rl1GStLpZvApXqm3Puw+Zd3T
eQ3YkgZVTJAHw+JpXHJVGtUR3hHzqKOE7rXQjlIGLn7tofmtW2y4iFNM7iguGPXX
wi8BzHYX6CKVyVH50kI8H8d17rMGVhrS+o0YwAzRYI89sh57aaqXt3zg19YG/DgW
cFDorjZym/MHOVfyyb1FEuY9yI/9nQ76+XokSYq1hW8Za96RplSXxQ9zhqy89/7j
/SLthjTKl/g=
=sLnh
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2024-0778-03 - An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, improper authorization, information leakage, insecure permissions, and open redirection vulnerabilities.
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which provides a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-30129: A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0 * CVE-2022-3171: A parsing issue with binary data in protobuf-java core and...
Red Hat Security Advisory 2023-4612-01 - Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.7.13 serves as a replacement for Red Hat support for Spring Boot 2.7.12, and includes security, bug fixes and enhancements. For more information, see the release notes linked in the References section. Issues addressed include bypass, code execution, denial of service, and deserialization vulnerabilities.
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-1471: A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malici...
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704.
Red Hat Security Advisory 2023-3954-01 - This release of Red Hat Fuse 7.12 serves as a replacement for Red Hat Fuse 7.11 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. Issues addressed include bypass, code execution, denial of service, information leakage, resource exhaustion, server-side request forgery, and traversal vulnerabilities.
A minor version update (from 7.11 to 7.12) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2012-5783: It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or su...
Red Hat OpenShift Container Platform release 4.10.62 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41966: A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow. * CVE-2023-20860: A flaw was found in Spring Framework. In this issue, a security bypass is possibl...
An update is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, and Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20860: A flaw was found in Spring Framework. In this issue, a security bypass is possible due to the behavior of the wildcard pattern. * CVE-2023-20861: A flaw found was found in Spring Framework. This flaw allows a malicious user to u...
An update is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, and Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20860: A flaw was found in Spring Framework. In this issue, a security bypass is possible due to the behavior of the wildcard pattern. * CVE-2023-20861: A flaw found was found in Spring Framework. This flaw allows a malicious user to u...
An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2048: A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests. * CVE-2022-22976: A flaw was found in Spring Framework. The encoder does not perform any salt rounds when using the BCrypt class with the maximum wo...
Red Hat Security Advisory 2023-3622-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, denial of service, information leakage, insecure permissions, and resource exhaustion vulnerabilities.
Red Hat Security Advisory 2023-3622-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, denial of service, information leakage, insecure permissions, and resource exhaustion vulnerabilities.
Red Hat Security Advisory 2023-3610-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, memory exhaustion, and resource exhaustion vulnerabilities.
Red Hat Security Advisory 2023-3610-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, memory exhaustion, and resource exhaustion vulnerabilities.
An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack. * CVE-2022-30953: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an...
An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack. * CVE-2022-30953: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an...
Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially exploit this vulnerability to retrieve the plain text.
Red Hat AMQ Broker 7.10.3 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3782: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wil...
Red Hat AMQ Broker 7.10.3 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3782: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wil...
Red Hat Security Advisory 2023-2100-01 - This release of Camel for Spring Boot 3.20.1 serves as a replacement for Camel for Spring Boot 3.18.3 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. The purpose of this text-only errata is to inform you about the security issues fixed. Issues addressed include bypass, code execution, cross site scripting, denial of service, man-in-the-middle, memory exhaustion, resource exhaustion, and traversal vulnerabilities.
Red Hat Security Advisory 2023-2100-01 - This release of Camel for Spring Boot 3.20.1 serves as a replacement for Camel for Spring Boot 3.18.3 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. The purpose of this text-only errata is to inform you about the security issues fixed. Issues addressed include bypass, code execution, cross site scripting, denial of service, man-in-the-middle, memory exhaustion, resource exhaustion, and traversal vulnerabilities.
Red Hat Integration Camel for Spring Boot 3.20.1 release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-37533: A flaw was found in Apache Commons Net's FTP, where the client trusts the host from PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This issue could lead to leakage of information about service...
Red Hat Integration Camel for Spring Boot 3.20.1 release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-37533: A flaw was found in Apache Commons Net's FTP, where the client trusts the host from PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This issue could lead to leakage of information about service...
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.