Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1-1 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2022-22965 — spring-framework: RCE via Data Binding on JDK 9+
🎯 Affected products1
- CEQ 2.2.1-1 (CVE-2022-22965)
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string "class.*" For full implementation details, see Spring's early announcement post in the "suggested workarounds" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2022:1306
- externalhttps://access.redhat.com/security/updates/classification/#low
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q1
- externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2022-003
- externalhttps://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2070348
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1306.json