RedHat: RHSA-2022-6757:01 Important: Red Hat build of Eclipse Vert....
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat build of Eclipse Vert.x 4.3.3 security update
Advisory ID:       RHSA-2022:6757-01
Product:           Red Hat OpenShift Application Runtimes
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6757
Issue date:        2022-10-05
CVE Names:         CVE-2022-25857 CVE-2022-37734 CVE-2022-38749 
                   CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 
=====================================================================

1. Summary:

An update is now available for Red Hat build of Eclipse Vert.x.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each
vulnerability. For more information, see the CVE pages listed in the
References section.

2. Description:

This release of Red Hat build of Eclipse Vert.x 4.3.3 GA includes security
updates. For more information, see the release notes listed in the
References section.

Security Fix(es):

* graphql-java: DoS by malicious query (CVE-2022-37734)

* snakeyaml: Denial of Service due missing to nested depth limitation for
collections. (CVE-2022-25857)

* snakeyaml: Uncaught exception in
org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

* snakeyaml: Uncaught exception in
org.yaml.snakeyaml.constructor.BaseConstructor.constructObject
(CVE-2022-38750)

* snakeyaml: Uncaught exception in
java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

* snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode
(CVE-2022-38752)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgements, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link for the
update. You must be logged in to download the update.

4. Bugs fixed (https://bugzilla.redhat.com/):

2126789 - CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections
2126809 - CVE-2022-37734 graphql-java: DoS by malicious query
2129706 - CVE-2022-38749 snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode
2129707 - CVE-2022-38750 snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject
2129709 - CVE-2022-38751 snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match
2129710 - CVE-2022-38752 snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode

5. References:

https://access.redhat.com/security/cve/CVE-2022-25857
https://access.redhat.com/security/cve/CVE-2022-37734
https://access.redhat.com/security/cve/CVE-2022-38749
https://access.redhat.com/security/cve/CVE-2022-38750
https://access.redhat.com/security/cve/CVE-2022-38751
https://access.redhat.com/security/cve/CVE-2022-38752
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.3.3
https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.3/html/release_notes_for_eclipse_vert.x_4.3/index

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYz3vqtzjgjWX9erEAQi9VA//ah/a8m6w+vF3lN9EKyUZV0rSz+GAdROZ
2TphMXRCy5i90GTo3eTnfNi5STX3SqIBi4l7iWqmS6q6i725/lgbpNzfdq/N76MO
K+ZKKb6g1O+pt7KYea2fOOxEQe3cVIjWoWgldj1woxaqav2Tq8zDwqIVi63RpjfJ
AUlBj2Y4JnxM/Mi/5GeMSQXDdO3NH2q/QT37o7BVNKqu/mwPpIEVD/ONEIA6Ccgo
ilb+lBMC/OG5zJzzCvsfc39H+ZZmGF4AFrcJtWO0JbUO2L2cjbEdCCdOafIpOG1M
qjyy5c7Lx4UdyPqo2nfpNiXYVgV9Mir7Kap1E0L3SSTrEe1rsjo7xNraR7RTRqGU
5kYYddJEaNxhb1hLtAPjcqZtyoWIFG+2IFj/JCPzxptWygYS6T3OtLfOgwgUAVrG
90yzeadFaQIfogE9lYWoukqTVKXhoaBnIkT4T2NX5ENJsUsVegSlBHRGk+1cwu3W
2jptWuaxyyKFDL+EU5Om2u+qaHa6ouEWydedEfY3is6f45ofRSdK7FaCPfoG/olT
HBdFMzLgHDCCJa7KMl8vX6Q7oo4XT76Noh5lksdkTPaU7tkwTJf1Xl1yKweq6LZx
MiWI99pMtmwqr3M8V2Xe5skddlAuQhHtZXUTpHYslaPij1Sfdxwu2XeSvlvWWkCd
2GF0dOmx62o=
=GBg6
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-6757:01 Important: Red Hat build of Eclipse Vert.x 4.3.3

An update is now available for Red Hat build of Eclipse Vert.x

Summary

This release of Red Hat build of Eclipse Vert.x 4.3.3 GA includes security updates. For more information, see the release notes listed in the References section.
Security Fix(es):
* graphql-java: DoS by malicious query (CVE-2022-37734)
* snakeyaml: Denial of Service due missing to nested depth limitation for collections. (CVE-2022-25857)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, back up your existing installation, includingall applications, configuration files, databases and database settings, andso on.The References section of this erratum contains a download link for theupdate. You must be logged in to download the update.

References

https://access.redhat.com/security/cve/CVE-2022-25857 https://access.redhat.com/security/cve/CVE-2022-37734 https://access.redhat.com/security/cve/CVE-2022-38749 https://access.redhat.com/security/cve/CVE-2022-38750 https://access.redhat.com/security/cve/CVE-2022-38751 https://access.redhat.com/security/cve/CVE-2022-38752 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.3.3 https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.3/html/release_notes_for_eclipse_vert.x_4.3/index

Package List

Severity
Advisory ID: RHSA-2022:6757-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6757
Issued Date: : 2022-10-05
CVE Names: CVE-2022-25857 CVE-2022-37734 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752

Topic

An update is now available for Red Hat build of Eclipse Vert.x.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for eachvulnerability. For more information, see the CVE pages listed in theReferences section.

Relevant Releases Architectures

Bugs Fixed

2126789 - CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections

2126809 - CVE-2022-37734 graphql-java: DoS by malicious query

2129706 - CVE-2022-38749 snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode

2129707 - CVE-2022-38750 snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject

2129709 - CVE-2022-38751 snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match

2129710 - CVE-2022-38752 snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.