Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 454
Alerts This Week
Warning Icon 1 454

Red Hat: RHSA-2023-5441-01 Moderate: Security Update for Camel

red hat
Calendar Grey October 4, 2023
Dist Redhat Esm H88
Apache Camel for Spring Boot 4.0.0 security patch resolves several vulnerabilities classified as Moderate.
Red Hat Integration Camel for Spring Boot 4.0.0 release and security update is now available

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).

Summary

Red Hat Integration Camel for Spring Boot 4.0.0 is now available. The purpose of this text-only errata is to inform you about the security issues fixed.
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44729)
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44730)
* apache-ivy: XML External Entity vulnerability (CVE-2022-46751)
* jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() (CVE-2023-26048)
* jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)
* apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale (CVE-2023-33008)
* netty: io.netty:netty-handler: SniHandler 16MB allocation (CVE-2023-34462)
* jetty-http: jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate severity xml external entity out of memory server-side request forgery red hat integration jetty server

References

https://access.redhat.com/security/cve/CVE-2022-44729 https://access.redhat.com/security/cve/CVE-2022-44730 https://access.redhat.com/security/cve/CVE-2022-46751 https://access.redhat.com/security/cve/CVE-2023-26048 https://access.redhat.com/security/cve/CVE-2023-26049 https://access.redhat.com/security/cve/CVE-2023-33008 https://access.redhat.com/security/cve/CVE-2023-34462 https://access.redhat.com/security/cve/CVE-2023-40167 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q4

Package List


Advisory ID: RHSA-2023:5441-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5441
Issue date: 2023-10-04

Topic

Red Hat Integration Camel for Spring Boot 4.0.0 release and security updateis now available.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate severity xml external entity out of memory server-side request forgery red hat integration jetty server

Relevant Releases Architectures

Bugs Fixed

2216888 - CVE-2023-34462 netty: SniHandler 16MB allocation leads to OOM

2221135 - CVE-2023-33008 apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

2233112 - CVE-2022-46751 apache-ivy: XML External Entity vulnerability

2233889 - CVE-2022-44729 batik: Server-Side Request Forgery vulnerability

2233899 - CVE-2022-44730 batik: Server-Side Request Forgery vulnerability

2236340 - CVE-2023-26048 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

2236341 - CVE-2023-26049 jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies

2239634 - CVE-2023-40167 jetty: Improper validation of HTTP/1 content-length

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.