RedHat: RHSA-2022-9032:01 Important: Red Hat build of Eclipse Vert....
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat build of Eclipse Vert.x 4.3.4 security update
Advisory ID:       RHSA-2022:9032-01
Product:           Red Hat OpenShift Application Runtimes
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:9032
Issue date:        2022-12-15
CVE Names:         CVE-2022-1471 CVE-2022-42003 CVE-2022-42004 
=====================================================================

1. Summary:

An update is now available for Red Hat build of Eclipse Vert.x.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each
vulnerability. For more information, see the CVE pages listed in the
References section.

2. Description:

This release of Red Hat build of Eclipse Vert.x 4.3.4 GA includes security
updates. For more information, see the release notes listed in the
References section.

Security Fix(es):

* snakeyaml: Constructor Deserialization Remote Code Execution
(CVE-2022-1471)

* jackson-databind: deep wrapper array nesting wrt
UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

* jackson-databind: use of deeply nested arrays (CVE-2022-42004)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgements, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link for the
update. You must be logged in to download the update.

4. Bugs fixed (https://bugzilla.redhat.com/):

2135244 - CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
2135247 - CVE-2022-42004 jackson-databind: use of deeply nested arrays
2150009 - CVE-2022-1471 SnakeYaml: Constructor Deserialization Remote Code Execution

5. References:

https://access.redhat.com/security/cve/CVE-2022-1471
https://access.redhat.com/security/cve/CVE-2022-42003
https://access.redhat.com/security/cve/CVE-2022-42004
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.3.4
https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.3/html/release_notes_for_eclipse_vert.x_4.3/index

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY5tMjNzjgjWX9erEAQg27BAAhyVZNJ5iJ/jfYLI1MZBtZ73nJvm5hHew
LpXPkPRGz/37ahr8rNwIqeWx/IbleB7easbUfYgRYG7RA79BZhTDU40S/c81X7Fc
OtVGA8hB9W0rRDt0VIV8HKwYxz+nPK3w2HWXMaQPsZA0PriqntxeL8sXOe3I51af
aAvFS74bWX50QyBY2bMb5L5apVPUOd7WBaEd0nfkA6XQcEcEFZJpkAJdq4isfYeV
FVEr1aM4yzFWpxo7P2sOlhsL1Fcl+kQx8iLNkf3CKU7iCbvxb4mrW7nvhm2o2lTG
JxqswFhXRDJLOvEIE0SskoSf7KEoKuoykN24zCzMO9sbirQm4cloRsZh6IFgbD8J
bB3imFaTIB4swVVIVzJ8ANCCSEshR+oOqgMe2uyi6rjQbLtc2GurW3KmOCQ2IfKz
DFaDsw0A/AcQJ4eUAk47eX3wlYbDN+G2s4zut8VgbFdlJetj9btfnG15zKJtOTXC
b9eXsIJTbGaItUBtm4GitO6YgY41RJuntKmtcLBJ3yYDJc8pAykmLEqRlm0Y0/S7
l/gmbx9FMoLtkFZTqxg6v3FmBxQhGxKy225yW8TZDC9Kz4guMuZF9woMEM44QRn9
rRResiBH2MpHD8bcmysZVoo3e0e4QpZbdhXOsPD4lf45djJpTYjrp9kE53YDkyLx
0RfunWsdRPQ=
=5ZIs
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-9032:01 Important: Red Hat build of Eclipse Vert.x 4.3.4

An update is now available for Red Hat build of Eclipse Vert.x

Summary

This release of Red Hat build of Eclipse Vert.x 4.3.4 GA includes security updates. For more information, see the release notes listed in the References section.
Security Fix(es):
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, back up your existing installation, includingall applications, configuration files, databases and database settings, andso on.The References section of this erratum contains a download link for theupdate. You must be logged in to download the update.

References

https://access.redhat.com/security/cve/CVE-2022-1471 https://access.redhat.com/security/cve/CVE-2022-42003 https://access.redhat.com/security/cve/CVE-2022-42004 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.3.4 https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.3/html/release_notes_for_eclipse_vert.x_4.3/index

Package List

Severity
Advisory ID: RHSA-2022:9032-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2022:9032
Issued Date: : 2022-12-15
CVE Names: CVE-2022-1471 CVE-2022-42003 CVE-2022-42004

Topic

An update is now available for Red Hat build of Eclipse Vert.x.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for eachvulnerability. For more information, see the CVE pages listed in theReferences section.

Relevant Releases Architectures

Bugs Fixed

2135244 - CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS

2135247 - CVE-2022-42004 jackson-databind: use of deeply nested arrays

2150009 - CVE-2022-1471 SnakeYaml: Constructor Deserialization Remote Code Execution

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.