RedHat: RHSA-2022-5606:01 Moderate: Red Hat Integration Camel Exten...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Integration Camel Extensions for Quarkus 2.7 security update
Advisory ID:       RHSA-2022:5606-01
Product:           Red Hat Integration
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5606
Issue date:        2022-07-19
CVE Names:         CVE-2020-9492 CVE-2021-3520 CVE-2021-22132 
                   CVE-2021-22135 CVE-2021-22137 CVE-2021-37714 
                   CVE-2021-38153 CVE-2021-43859 CVE-2022-0981 
=====================================================================

1. Summary:

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The
purpose of this text-only errata is to inform you about the security issues
fixed.

Red Hat Product Security has rated this update as having an impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Integration - Camel Extensions for Quarkus 2.7 serves as a
replacement for 2.2.1 and includes the following security Fix(es):

Security Fix(es):

* hadoop: WebHDFS client might send SPNEGO authorization header
(CVE-2020-9492)

* lz4: memory corruption due to an integer overflow bug caused by memmove
argument (CVE-2021-3520)

* elasticsearch: executing async search improperly stores HTTP headers
leading to information disclosure (CVE-2021-22132)

* jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
(CVE-2021-37714)

* Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients
(CVE-2021-38153)

* xstream: Injecting highly recursive collections or maps can cause a DoS
(CVE-2021-43859)

* quarkus: privilege escalation vulnerability with RestEasy Reactive scope
leakage in Quarkus (CVE-2022-0981)

* elasticsearch: Document disclosure flaw in the Elasticsearch suggester
(CVE-2021-22135)

* elasticsearch: Document disclosure flaw when Document or Field Level
Security is used (CVE-2021-22137)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

1923181 - CVE-2021-22132 elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure
1925237 - CVE-2020-9492 hadoop: WebHDFS client might send SPNEGO authorization header
1943184 - CVE-2021-22135 elasticsearch: Document disclosure flaw in the Elasticsearch suggester
1943189 - CVE-2021-22137 elasticsearch: Document disclosure flaw when Document or Field Level Security is used
1954559 - CVE-2021-3520 lz4: memory corruption due to an integer overflow bug caused by memmove argument
1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
2009041 - CVE-2021-38153 Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients
2049783 - CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS
2062520 - CVE-2022-0981 quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

5. References:

https://access.redhat.com/security/cve/CVE-2020-9492
https://access.redhat.com/security/cve/CVE-2021-3520
https://access.redhat.com/security/cve/CVE-2021-22132
https://access.redhat.com/security/cve/CVE-2021-22135
https://access.redhat.com/security/cve/CVE-2021-22137
https://access.redhat.com/security/cve/CVE-2021-37714
https://access.redhat.com/security/cve/CVE-2021-38153
https://access.redhat.com/security/cve/CVE-2021-43859
https://access.redhat.com/security/cve/CVE-2022-0981
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q3
https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q3

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuFkGtzjgjWX9erEAQg+hQ//Wee1BsmMMfrPXtV4V+HuBI/Do2QWTg3+
3ueJ8c0X2YdIpEwcMKR+wgpaPUv79+zHDlRu8X2J0YhIFN+FYFT0jEjb0T4d85SU
3pN2rqwQwM4fcDcVd/88iH6HJxg9u6ii51/CK2p2EnDLTgb/MuLuq3RYoLdWpiJt
hoK0XR7g2e8B1U7AiFQO+X4lo/+yH5fEK9sk76KU3KjL40dmkypx5YfSFDH0hB1V
93vv5JonX90AiS/Gr7vCaRzjgw/j86fl+pizJSaHuM87JghrdS6MC1Ij6afgBEM2
DSSXBl3z5mtNfLQ+Np0zCrLG/zkLrM1b4sfm72URdL+XDaMM2wce2gGMYtEjQKF9
rLPvror86VhJkpEJo8J/7pua/mmviI3cUWe9QFY7txrBDpQcv0IgDtylucOp1k/1
yphA41dYJYMIk2eD06R+qr+4ItTJbCO0Q/OCbhqd3m2eT9iXfbclxtkJvUTebjSt
/kTJ4kkCALUdZv6MbkrhrBIEFxBbF0hl8F/OevgVcP+6F6MZ7mSGRFrrX3cEVg3O
uXiNHrjHp5mAzn8e0IMfitgXYlgnkX68A8E+WT6c4pszeZaow+6j/ny5ePEqj5VN
cVJETyagr0mVydi6UyaclyAQ1rrwtR0+WefEUnib9OAio5tKFZywphiSYgSJf7YC
NTP5FhJoQ2g=
=O0fk
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5606:01 Moderate: Red Hat Integration Camel Extensions

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available

Summary

Red Hat Integration - Camel Extensions for Quarkus 2.7 serves as a replacement for 2.2.1 and includes the following security Fix(es):
Security Fix(es):
* hadoop: WebHDFS client might send SPNEGO authorization header (CVE-2020-9492)
* lz4: memory corruption due to an integer overflow bug caused by memmove argument (CVE-2021-3520)
* elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure (CVE-2021-22132)
* jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)
* Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVE-2021-38153)
* xstream: Injecting highly recursive collections or maps can cause a DoS (CVE-2021-43859)
* quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus (CVE-2022-0981)
* elasticsearch: Document disclosure flaw in the Elasticsearch suggester (CVE-2021-22135)
* elasticsearch: Document disclosure flaw when Document or Field Level Security is used (CVE-2021-22137)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-9492 https://access.redhat.com/security/cve/CVE-2021-3520 https://access.redhat.com/security/cve/CVE-2021-22132 https://access.redhat.com/security/cve/CVE-2021-22135 https://access.redhat.com/security/cve/CVE-2021-22137 https://access.redhat.com/security/cve/CVE-2021-37714 https://access.redhat.com/security/cve/CVE-2021-38153 https://access.redhat.com/security/cve/CVE-2021-43859 https://access.redhat.com/security/cve/CVE-2022-0981 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q3 https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q3

Package List

Severity
Advisory ID: RHSA-2022:5606-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5606
Issued Date: : 2022-07-19
CVE Names: CVE-2020-9492 CVE-2021-3520 CVE-2021-22132 CVE-2021-22135 CVE-2021-22137 CVE-2021-37714 CVE-2021-38153 CVE-2021-43859 CVE-2022-0981

Topic

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. Thepurpose of this text-only errata is to inform you about the security issuesfixed.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

1923181 - CVE-2021-22132 elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

1925237 - CVE-2020-9492 hadoop: WebHDFS client might send SPNEGO authorization header

1943184 - CVE-2021-22135 elasticsearch: Document disclosure flaw in the Elasticsearch suggester

1943189 - CVE-2021-22137 elasticsearch: Document disclosure flaw when Document or Field Level Security is used

1954559 - CVE-2021-3520 lz4: memory corruption due to an integer overflow bug caused by memmove argument

1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

2009041 - CVE-2021-38153 Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients

2049783 - CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS

2062520 - CVE-2022-0981 quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.