Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat Integration 2.7 RHSA-2022:5606-01 Moderate: Multiple Threat Fixes

red hat
Calendar Grey July 27, 2022
Dist Redhat Esm H88
Stay updated on Red Hat Integration Camel Extensions for Quarkus 2.7, focusing on security issues and moderate impacts.
Red Hat Integration Camel Extensions for Quarkus 2.7 is now available

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Red Hat Integration - Camel Extensions for Quarkus 2.7 serves as a replacement for 2.2.1 and includes the following security Fix(es):
Security Fix(es):
* hadoop: WebHDFS client might send SPNEGO authorization header (CVE-2020-9492)
* lz4: memory corruption due to an integer overflow bug caused by memmove argument (CVE-2021-3520)
* elasticsearch: executing async search improperly stores HTTP headersleading to information disclosure (CVE-2021-22132)
* jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)
* Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVE-2021-38153)
* xstream: Injecting highly recursive collections or maps can cause a DoS (CVE-2021-43859)
* quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus (CVE-2022-0981)
* elasticsearch: Document disclosure flaw in the Elasticsearch suggester (CVE-2021-22135)
* elasticsearch: Document disclosure flaw when Document or Field Level Security is used (CVE-2021-22137)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory security issue moderate severity threat fix red hat integration camel extensions

References

https://access.redhat.com/security/cve/CVE-2020-9492 https://access.redhat.com/security/cve/CVE-2021-3520 https://access.redhat.com/security/cve/CVE-2021-22132 https://access.redhat.com/security/cve/CVE-2021-22135 https://access.redhat.com/security/cve/CVE-2021-22137 https://access.redhat.com/security/cve/CVE-2021-37714 https://access.redhat.com/security/cve/CVE-2021-38153 https://access.redhat.com/security/cve/CVE-2021-43859 https://access.redhat.com/security/cve/CVE-2022-0981 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q3 https://docs.redhat.com/en/documentation/red_hat_integration/2022.q3

Package List


Advisory ID: RHSA-2022:5606-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5606
Issue date: 2022-07-19

Topic

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. Thepurpose of this text-only errata is to inform you about the security issuesfixed.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue moderate severity threat fix red hat integration camel extensions

Relevant Releases Architectures

Bugs Fixed

1923181 - CVE-2021-22132 elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

1925237 - CVE-2020-9492 hadoop: WebHDFS client might send SPNEGO authorization header

1943184 - CVE-2021-22135 elasticsearch: Document disclosure flaw in the Elasticsearch suggester

1943189 - CVE-2021-22137 elasticsearch: Document disclosure flaw when Document or Field Level Security is used

1954559 - CVE-2021-3520 lz4: memory corruption due to an integer overflow bug caused by memmove argument

1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

2009041 - CVE-2021-38153 Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients

2049783 - CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS

2062520 - CVE-2022-0981 quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here