Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Red Hat: RHSA-2021-4767-03 Moderate: Integration Camel Extensions DoS Risk

red hat
Calendar Grey November 23, 2021
Dist Redhat Esm H88
Official Red Hat Security Announcement pertaining to Integration Camel Extensions, tackling several vulnerabilities found within Quarkus.
Red Hat Integration Camel Extensions for Quarkus 2.2 is now GA

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

This release of Red Hat Integration - Camel Extensions for Quarkus - 2.2 GA serves as a replacement for tech-preview 2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* jetty (CVE-2021-28163, CVE-2020-27218, CVE-2020-27223, CVE-2021-28164, CVE-2021-28169, CVE-2021-28165, CVE-2021-34428, CVE-2021-34428)
* undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)
* xstream (CVE-2021-39144, CVE-2021-39141, CVE-2021-39154, CVE-2021-39153, CVE-2021-39152, CVE-2021-39151, CVE-2021-39150, CVE-2021-39149, CVE-2021-39148, CVE-2021-39147, CVE-2021-39146, CVE-2021-39145, CVE-2021-39140, CVE-2021-39139, CVE-2021-21351, CVE-2021-21350, CVE-2021-21349, CVE-2021-21348, CVE-2021-21347, CVE-2021-21346, CVE-2021-21345, CVE-2021-21344, CVE-2021-21343, CVE-2021-21342, CVE-2021-21341, CVE-2021-29505, CVE-2020-26259, CVE-2020-26258, CVE-2020-26217)
* wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)
* RESTEasy: Caching routes in RootNode may result in DoS (CVE-2020-14326)
* resteasy-core: resteasy: Error message exposes endpoint class information (CVE-2021-20289)
* velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)
* undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
* mongodb-driver: mongo-java-driver: client-side field level encryption not verifying KMS host name (CVE-2021-20328)
* gradle: information disclosure through temporary directory permissions (CVE-2021-29429)
* json-smart: uncaught exception may lead to crash or information disclosure (CVE-2021-27568)
* bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)
* jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception (CVE-2020-28491)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issues dos quarkus red hat integration camel extensions

References

https://access.redhat.com/security/cve/CVE-2020-13936 https://access.redhat.com/security/cve/CVE-2020-14326 https://access.redhat.com/security/cve/CVE-2020-26217 https://access.redhat.com/security/cve/CVE-2020-26258 https://access.redhat.com/security/cve/CVE-2020-26259 https://access.redhat.com/security/cve/CVE-2020-27218 https://access.redhat.com/security/cve/CVE-2020-27223 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2020-28491 https://access.redhat.com/security/cve/CVE-2021-3629 https://access.redhat.com/security/cve/CVE-2021-3642 https://access.redhat.com/security/cve/CVE-2021-3690 https://access.redhat.com/security/cve/CVE-2021-20289 https://access.redhat.com/security/cve/CVE-2021-20328 https://access.redhat.com/security/cve/CVE-2021-21341 https://access.redhat.com/security/cve/CVE-2021-21342 https://access.redhat.com/security/cve/CVE-2021-21343 https://access.redhat.com/security/cve/CVE-2021-21344 https://access.redhat.com/security/cve/CVE-2021-21345 https://access.redhat.com/security/cve/CVE-2021-21346 https://access.redhat.com/security/cve/CVE-2021-21347 https://access.redhat.com/security/cve/CVE-2021-21348 https://access.redhat.com/security/cve/CVE-2021-21349 Read the Full Advisory

Package List


Advisory ID: RHSA-2021:4767-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4767
Issue date: 2021-11-23

Topic

Red Hat Integration Camel Extensions for Quarkus 2.2 is now GA. The purposeof this text-only errata is to inform you about the security issues fixedsince the tech preview 2 release.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issues dos quarkus red hat integration camel extensions

Relevant Releases Architectures

Bugs Fixed

1855826 - CVE-2020-14326 RESTEasy: Caching routes in RootNode may result in DoS

1898907 - CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists

1902826 - CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation

1908832 - CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling

1908837 - CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling

1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

1930423 - CVE-2020-28491 jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception

1934116 - CVE-2020-27223 jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

1934236 - CVE-2021-20328 mongo-java-driver: client-side field level encryption not verifying KMS host name

1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information

1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates

1939839 - CVE-2021-27568 json-smart: uncaught exception may lead to crash or information disclosure

1942539 - CVE-2021-21341 XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here