RedHat: RHSA-2023-5441:01 Moderate: Red Hat Integration Camel for Spring
Summary
Red Hat Integration Camel for Spring Boot 4.0.0 is now available. The
purpose of this text-only errata is to inform you about the security issues
fixed.
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44729)
* batik: Server-Side Request Forgery vulnerability (CVE-2022-44730)
* apache-ivy: XML External Entity vulnerability (CVE-2022-46751)
* jetty-server: OutOfMemoryError for large multipart without filename read
via request.getParameter() (CVE-2023-26048)
* jetty-server: Cookie parsing of quoted values can exfiltrate values from
other cookies (CVE-2023-26049)
* apache-johnzon: Prevent inefficient internal conversion from BigDecimal
at large scale (CVE-2023-33008)
* netty: io.netty:netty-handler: SniHandler 16MB allocation
(CVE-2023-34462)
* jetty-http: jetty: Improper validation of HTTP/1 content-length
(CVE-2023-40167)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link (you must
log in to download the update).
References
https://access.redhat.com/security/cve/CVE-2022-44729 https://access.redhat.com/security/cve/CVE-2022-44730 https://access.redhat.com/security/cve/CVE-2022-46751 https://access.redhat.com/security/cve/CVE-2023-26048 https://access.redhat.com/security/cve/CVE-2023-26049 https://access.redhat.com/security/cve/CVE-2023-33008 https://access.redhat.com/security/cve/CVE-2023-34462 https://access.redhat.com/security/cve/CVE-2023-40167 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q4
Package List
Topic
Red Hat Integration Camel for Spring Boot 4.0.0 release and security updateis now available.Red Hat Product Security has rated this update as having an impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
2216888 - CVE-2023-34462 netty: SniHandler 16MB allocation leads to OOM
2221135 - CVE-2023-33008 apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
2233112 - CVE-2022-46751 apache-ivy: XML External Entity vulnerability
2233889 - CVE-2022-44729 batik: Server-Side Request Forgery vulnerability
2233899 - CVE-2022-44730 batik: Server-Side Request Forgery vulnerability
2236340 - CVE-2023-26048 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
2236341 - CVE-2023-26049 jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies
2239634 - CVE-2023-40167 jetty: Improper validation of HTTP/1 content-length
