Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Red Hat Integration Camel Extensions 2.2.1: Addressing Unauthenticated RCE

red hat
Calendar Grey March 22, 2022
Dist Redhat Esm H88
The latest Red Hat Integration Camel Extensions release tackles various medium-level security vulnerabilities. Confirm that your systems maintain their security integrity.
A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

Red Hat Integration - Camel Extensions for Quarkus 2.2.1 serves as a replacement for 2.2 and includes the following security Fix(es):
Security Fix(es):
* cron-utils: template Injection leading to unauthenticated Remote Code Execution (CVE-2021-41269)
* maven: Block repositories using http by default (CVE-2021-26291)
* bouncycastle: Timing issue within the EC math library (CVE-2020-15522)
* mysql-connector-java: unauthorized access to critical (CVE-2021-2471)
* kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)
* protobuf-java: potential DoS in the parsing procedure for binary data (CVE-2021-22569)
* jersey: Local information disclosure via system temporary directory (CVE-2021-28168)
* jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
* mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)
* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)
* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)
* xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)
* h2: Remote Code Execution in Console (CVE-2021-42392)
* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate remote code execution security fix Red Hat Integration Camel Extensions Quarkus 2.2.1

References

https://access.redhat.com/security/cve/CVE-2020-8908 https://access.redhat.com/security/cve/CVE-2020-15522 https://access.redhat.com/security/cve/CVE-2021-2471 https://access.redhat.com/security/cve/CVE-2021-4178 https://access.redhat.com/security/cve/CVE-2021-22569 https://access.redhat.com/security/cve/CVE-2021-26291 https://access.redhat.com/security/cve/CVE-2021-28168 https://access.redhat.com/security/cve/CVE-2021-28170 https://access.redhat.com/security/cve/CVE-2021-30129 https://access.redhat.com/security/cve/CVE-2021-37136 https://access.redhat.com/security/cve/CVE-2021-37137 https://access.redhat.com/security/cve/CVE-2021-40690 https://access.redhat.com/security/cve/CVE-2021-41269 https://access.redhat.com/security/cve/CVE-2021-42392 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q2 https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q2

Package List


Advisory ID: RHSA-2022:1013-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1013
Issue date: 2022-03-22

Topic

A security update to Red Hat Integration Camel Extensions for Quarkus 2.2is now available. The purpose of this text-only errata is to inform youabout the security issues fixed.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate remote code execution security fix Red Hat Integration Camel Extensions Quarkus 2.2.1

Relevant Releases Architectures

Bugs Fixed

1906919 - CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions

1953024 - CVE-2021-28168 jersey: Local information disclosure via system temporary directory

1955739 - CVE-2021-26291 maven: Block repositories using http by default

1962879 - CVE-2020-15522 bouncycastle: Timing issue within the EC math library

1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

1981527 - CVE-2021-30129 mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server

2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

2011190 - CVE-2021-40690 xml-security: XPath Transform abuse allows for information disclosure

2020583 - CVE-2021-2471 mysql-connector-java: unauthorized access to critical

2024632 - CVE-2021-41269 cron-utils: template Injection leading to unauthenticated Remote Code Execution

2034388 - CVE-2021-4178 kubernetes-client: Insecure deserialization in unmarshalYaml method

2039403 - CVE-2021-42392 h2: Remote Code Execution in Console

2039903 - CVE-2021-22569 protobuf-java: potential DoS in the parsing procedure for binary data

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here