RHSA-2022:8652HighCVSS 9.8

Red Hat Security Advisory: Red Hat Fuse 7.11.1 release and security update

Published
November 28, 2022
Last Modified
August 7, 2026

🔗 CVE IDs covered (17)

CVE-2019-8331 →CVE-2022-24785 →CVE-2022-24823 →CVE-2022-42889 →CVE-2022-24723 →CVE-2022-31197 →CVE-2022-41853 →CVE-2021-44906 →CVE-2022-2048 →CVE-2022-31129 →CVE-2022-38749 →CVE-2021-3717 →CVE-2021-31684 →CVE-2022-0613 →CVE-2022-2053 →CVE-2022-25857 →CVE-2022-33980 →

📋 Description

CVE-2019-8331 — bootstrap: XSS in the tooltip or popover data-template attribute CVE-2021-3717 — wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users CVE-2021-31684 — json-smart: Denial of Service in JSONParserByteArray function CVE-2021-44906 — minimist: prototype pollution CVE-2022-0613 — urijs: Authorization Bypass Through User-Controlled Key CVE-2022-2048 — http2-server: Invalid HTTP/2 requests cause DoS CVE-2022-2053 — undertow: Large AJP request may cause DoS CVE-2022-24723 — urijs: Leading white space bypasses protocol validation CVE-2022-24785 — Moment.js: Path traversal in moment.locale CVE-2022-24823 — netty: world readable temporary file containing sensitive data CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-31129 — moment: inefficient parsing algorithm resulting in DoS CVE-2022-31197 — postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names CVE-2022-33980 — apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults CVE-2022-38749 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode CVE-2022-41853 — hsqldb: Untrusted input may lead to RCE attack CVE-2022-42889 — apache-commons-text: variable interpolation RCE

🎯 Affected products1

  • Red Hat Fuse 7.11.1

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.11.1 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.11/ Workaround: Sanitize the user-provided locale name before passing it to Moment.js. Workaround: As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. Workaround: By default, the static methods of any class that is on the classpath are available for use and can compromise security in some systems. The optional Java system property, hsqldb.method_class_names, allows preventing access to classes other than java.lang.Math or specifying a semicolon-separated list of allowed classes. A property value that ends with .* is treated as a wild card and allows access to all class or method names formed by substitution of the * (asterisk). In the example below, the property has been included as an argument to the Java command. java -Dhsqldb.method_class_names="org.me.MyClass;org.you.YourClass;org.you.lib.*" [the rest of the command line] The above example allows access to the methods in the two classes: org.me.MyClass and org.you.YourClass together with all the classes in the org.you.lib package. Note that if the property is not defined, no access control is performed at this level. The user who creates a Java routine must have the relevant access privileges on the tables that are used inside the Java method. Once the routine has been defined, the normal database access control applies to its user. The routine can be executed only by those users who have been granted EXECUTE privileges on it. Access to routines can be granted to users with GRANT EXECUTE or GRANT ALL. For example, GRANT EXECUTE ON myroutine TO PUBLIC. In hsqldb 2.7.1, all classes by default are not accessible, except those in java.lang.Math and need to be manually enabled. Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

🔗 References (20)