RHSA-2021:3140 Red Hat Security Advisory: Red Hat Fuse 7.9.0 release and security update
log4j: Socket receiver deserialization vulnerability snakeyaml: Billion laughs attack via alias feature apache-commons-compress: Infinite loop in name encoding algorithm wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class olingo-odata: Server side request forgery in AsyncResponseWrapperImpl tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack springframework: RFD protection bypass via jsessionid Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 tomcat: deserialization flaw in session persistence storage leading to RCE RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack hibernate-validator: Improper input validation in the interpolation of constraint error messages wildfly-elytron: session fixation when using FORM authentication undertow: invalid HTTP request with large chunk size tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS activemq: improper authentication allows MITM attack tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS velocity: arbitrary code execution when attacker is able to modify templates cxf: XSS via the styleSheetPath apache-httpclient: incorrect handling of malformed authority component in request URIs golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash wildfly: Some EJB transaction objects may get accumulated causing Denial of Service wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS shiro: specially crafted HTTP request may cause an authentication bypass apache-flink: directory traversal attack allows remote file writing through the REST API resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used wildfly: resource adapter logs plaintext JMS password at warning level on connection error wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling mybatis: mishandles deserialization of object streams which could result in remote code execution jetty: local temporary directory hijacking vulnerability bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible json-smart: uncaught exception may lead to crash or information disclosure pdfbox: infinite loop while loading a crafted PDF file pdfbox: OutOfMemory-Exception while loading a crafted PDF file jetty: Resource exhaustion when receiving an invalid large TLS frame
CVSS v3.1 score: 7.5
CVSS v3.0 score: 7.5