RHSA-2020:3806HighCVSS 7.5

Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6.SP2 security update

Published
September 23, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2020-10688 →CVE-2020-10693 →CVE-2020-13934 →CVE-2020-13935 →

📋 Description

CVE-2020-10688 — RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack CVE-2020-10693 — hibernate-validator: Improper input validation in the interpolation of constraint error messages CVE-2020-13934 — tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS CVE-2020-13935 — tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

🎯 Affected products1

  • Red Hat Runtimes Spring Boot 2.2.6

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: You can pass user input as an expression variable by unwrapping the context to HibernateConstraintValidatorContext. Please refer to the https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/ and https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.

🔗 References (9)