RHSA-2021:5134 Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update
nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete log4j: improper validation of certificate with host mismatch in SMTP appender batik: SSRF due to improper input validation by the NodePickerPanel xmlgraphics-commons: SSRF due to improper input validation by the XMPParser tomcat: Apache Tomcat HTTP/2 Request mix-up libthrift: potential DoS when processing untrusted payloads bouncycastle: Timing issue within the EC math library groovy: OS temporary directory leads to information disclosure tomcat: HTTP/2 request header mix-up XStream: remote code execution due to insecure XML deserialization when relying on blocklists XStream: arbitrary file deletion on the local host when unmarshalling jetty: buffer not correctly recycled in Gzip Request inflation jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS undertow: special character in query results in server errors jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client wildfly: XSS via admin console when creating roles in domain mode undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS undertow: potential security issue in flow control over HTTP/2 may lead to DOS undertow: buffer leak on incoming websocket PONG message may lead to DoS fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream XStream: SSRF via crafted input stream XStream: arbitrary file deletion on the local host via crafted input stream XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator XStream: ReDoS vulnerability XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream netty: Request smuggling via content-length header spring-web: (re)creating the temporary storage directory could result in  a privilege escalation within WebFlux application cxf: OAuth 2 authorization service vulnerable to DDos attacks xmlbeans: allowed malicious XML input may lead to XML Entity Expansion attack json-smart: uncaught exception may lead to crash or information disclosure jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter jetty: SessionListener can prevent a session from being invalidated breaking logout netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value
CVSS v3.1 score: 9.8
CVSS v3.0 score: 9.1