-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
Advisory ID:       RHSA-2023:5441-01
Product:           Red Hat Integration
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5441
Issue date:        2023-10-04
CVE Names:         CVE-2022-44729 CVE-2022-44730 CVE-2022-46751 
                   CVE-2023-26048 CVE-2023-26049 CVE-2023-33008 
                   CVE-2023-34462 CVE-2023-40167 
=====================================================================

1. Summary:

Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
is now available.

Red Hat Product Security has rated this update as having an impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Integration Camel for Spring Boot 4.0.0 is now available. The
purpose of this text-only errata is to inform you about the security issues
fixed.

* batik: Server-Side Request Forgery vulnerability (CVE-2022-44729)

* batik: Server-Side Request Forgery vulnerability (CVE-2022-44730)

* apache-ivy: XML External Entity vulnerability (CVE-2022-46751)

* jetty-server: OutOfMemoryError for large multipart without filename read
via request.getParameter() (CVE-2023-26048)

* jetty-server: Cookie parsing of quoted values can exfiltrate values from
other cookies (CVE-2023-26049)

* apache-johnzon: Prevent inefficient internal conversion from BigDecimal
at large scale (CVE-2023-33008)

* netty: io.netty:netty-handler: SniHandler 16MB allocation
(CVE-2023-34462)

* jetty-http: jetty: Improper validation of HTTP/1 content-length
(CVE-2023-40167)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

2216888 - CVE-2023-34462 netty: SniHandler 16MB allocation leads to OOM
2221135 - CVE-2023-33008 apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
2233112 - CVE-2022-46751 apache-ivy: XML External Entity vulnerability
2233889 - CVE-2022-44729 batik: Server-Side Request Forgery vulnerability
2233899 - CVE-2022-44730 batik: Server-Side Request Forgery vulnerability
2236340 - CVE-2023-26048 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
2236341 - CVE-2023-26049 jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies
2239634 - CVE-2023-40167 jetty: Improper validation of HTTP/1 content-length

5. References:

https://access.redhat.com/security/cve/CVE-2022-44729
https://access.redhat.com/security/cve/CVE-2022-44730
https://access.redhat.com/security/cve/CVE-2022-46751
https://access.redhat.com/security/cve/CVE-2023-26048
https://access.redhat.com/security/cve/CVE-2023-26049
https://access.redhat.com/security/cve/CVE-2023-33008
https://access.redhat.com/security/cve/CVE-2023-34462
https://access.redhat.com/security/cve/CVE-2023-40167
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q4

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHYSlAAoJENzjgjWX9erEY5sP/2dMIE7R17o8VqlZdqqId2PD
m7WiE/9WiEgtKr7540nykn3dMB8wt5IrAan7UhCQ60S2Q+xtlXKRsTxKWxmOtp/F
cyOUufeXQsnl0hF68sBrTKgUKYzmOnsUSQXOnF8Hq9jgRPcDhq288F3T60cJZk3o
mkibHlqe+1Gbr7rzeDtmdCiqDhlWSoTRgy9Q1xGVubica8sXhelc430Fm11pLms1
CzY6VXxD6t1WRnJ7k//pPVguqGsZytLBPlLclsFXa9CG4fNaN/m2jCncLEuaOZxN
K5Ap6IGTqUow2dzY4N4k0v6V24srZtSFt+dFknwrjSaUeEl0p8H6wl11UJrW3DL5
1IizSST8NXrd783a1pqNTKD5iwgJ/94jpm673kzDxDZCoueFbc1ER/YOtQg5bCAd
nzdormAVtnOBIzwVUi4l0l5bk0BMtfD0E8xHZeN502DJfAABZH27D3r7LnOgyXkj
MjoMmMRtAl4xKeH3GlM1fyIYu3jHSsrId9ykTEZwvlegtFIKSTUF0/Znz7pSfO/w
eMIvqinTX/rZ6Wjy4ENntMFvpFDkTastJLrsKmeSm+/mV44l9v76m/Oylsro/ui2
b9IuKcyJW2WGEosT++VUpgMrdJ8BWhBfirGpa1rh4fRQDh4NlB7VjiXwccHbEH2A
lVwPfcWEn2MqKPtlx/vU
=0Oie
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-5441:01 Moderate: Red Hat Integration Camel for Spring

Red Hat Integration Camel for Spring Boot 4.0.0 release and security update is now available

Summary

Red Hat Integration Camel for Spring Boot 4.0.0 is now available. The purpose of this text-only errata is to inform you about the security issues fixed.
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44729)
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44730)
* apache-ivy: XML External Entity vulnerability (CVE-2022-46751)
* jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() (CVE-2023-26048)
* jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)
* apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale (CVE-2023-33008)
* netty: io.netty:netty-handler: SniHandler 16MB allocation (CVE-2023-34462)
* jetty-http: jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).

References

https://access.redhat.com/security/cve/CVE-2022-44729 https://access.redhat.com/security/cve/CVE-2022-44730 https://access.redhat.com/security/cve/CVE-2022-46751 https://access.redhat.com/security/cve/CVE-2023-26048 https://access.redhat.com/security/cve/CVE-2023-26049 https://access.redhat.com/security/cve/CVE-2023-33008 https://access.redhat.com/security/cve/CVE-2023-34462 https://access.redhat.com/security/cve/CVE-2023-40167 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q4

Package List


Severity
Advisory ID: RHSA-2023:5441-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5441
Issued Date: : 2023-10-04
CVE Names: CVE-2022-44729 CVE-2022-44730 CVE-2022-46751 CVE-2023-26048 CVE-2023-26049 CVE-2023-33008 CVE-2023-34462 CVE-2023-40167

Topic

Red Hat Integration Camel for Spring Boot 4.0.0 release and security updateis now available.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

2216888 - CVE-2023-34462 netty: SniHandler 16MB allocation leads to OOM

2221135 - CVE-2023-33008 apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

2233112 - CVE-2022-46751 apache-ivy: XML External Entity vulnerability

2233889 - CVE-2022-44729 batik: Server-Side Request Forgery vulnerability

2233899 - CVE-2022-44730 batik: Server-Side Request Forgery vulnerability

2236340 - CVE-2023-26048 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

2236341 - CVE-2023-26049 jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies

2239634 - CVE-2023-40167 jetty: Improper validation of HTTP/1 content-length


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo