RHSA-2023:2100HighCVSS 9.8

Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.20.1 security update

Published
May 3, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (35)

CVE-2022-41853 →CVE-2022-42890 →CVE-2022-38648 →CVE-2022-38750 →CVE-2022-40151 →CVE-2022-40156 · pendingCVE-2023-1370 →CVE-2023-22602 →CVE-2022-42003 →CVE-2022-31777 →CVE-2022-40152 →CVE-2022-41966 →CVE-2022-37865 →CVE-2022-37866 →CVE-2022-38398 →CVE-2022-38749 →CVE-2023-24998 →CVE-2022-41881 →CVE-2023-20860 →CVE-2022-33681 →CVE-2022-41854 →CVE-2023-20861 →CVE-2023-20863 →CVE-2021-37533 →CVE-2022-25857 →CVE-2022-38751 →CVE-2022-38752 →CVE-2022-39368 →CVE-2022-40146 →CVE-2022-40150 →CVE-2023-1436 →CVE-2022-42004 →CVE-2022-4492 →CVE-2022-41704 →CVE-2022-41852 · pending

📋 Description

CVE-2021-37533 — apache-commons-net: FTP client trusts the host from PASV response by default CVE-2022-4492 — undertow: Server identity in https connection is not checked by the undertow client CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-31777 — apache-spark: XSS vulnerability in log viewer UI Javascript CVE-2022-33681 — Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM CVE-2022-37865 — apache-ivy: Directory Traversal CVE-2022-37866 — Ivy: Ivy Path traversal CVE-2022-38398 — batik: Server-Side Request Forgery CVE-2022-38648 — batik: Server-Side Request Forgery CVE-2022-38749 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode CVE-2022-38750 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject CVE-2022-38751 — snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match CVE-2022-38752 — snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode CVE-2022-39368 — scandium: Failing DTLS handshakes may cause throttling to block processing of records CVE-2022-40146 — batik: Server-Side Request Forgery (SSRF) vulnerability CVE-2022-40150 — jettison: memory exhaustion via user-supplied XML or JSON data CVE-2022-40151 — xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-40152 — woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-40156 — xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-41704 — batik: Apache XML Graphics Batik vulnerable to code execution via SVG CVE-2022-41852 — JXPath: untrusted XPath expressions may lead to RCE attack CVE-2022-41853 — hsqldb: Untrusted input may lead to RCE attack CVE-2022-41854 — dev-java/snakeyaml: DoS via stack overflow CVE-2022-41881 — codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS CVE-2022-41966 — xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2022-42890 — batik: Untrusted code execution in Apache XML Graphics Batik CVE-2023-1370 — json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) CVE-2023-1436 — jettison: Uncontrolled Recursion in JSONArray CVE-2023-20860 — springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2023-20861 — springframework: Spring Expression DoS Vulnerability CVE-2023-20863 — springframework: Spring Expression DoS Vulnerability CVE-2023-22602 — shiro: Authentication bypass through a specially crafted HTTP request CVE-2023-24998 — FileUpload: FileUpload DoS with excessive parts

🎯 Affected products1

  • RHINT Camel-Springboot 3.20.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: By default, the static methods of any class that is on the classpath are available for use and can compromise security in some systems. The optional Java system property, hsqldb.method_class_names, allows preventing access to classes other than java.lang.Math or specifying a semicolon-separated list of allowed classes. A property value that ends with .* is treated as a wild card and allows access to all class or method names formed by substitution of the * (asterisk). In the example below, the property has been included as an argument to the Java command. java -Dhsqldb.method_class_names="org.me.MyClass;org.you.YourClass;org.you.lib.*" [the rest of the command line] The above example allows access to the methods in the two classes: org.me.MyClass and org.you.YourClass together with all the classes in the org.you.lib package. Note that if the property is not defined, no access control is performed at this level. The user who creates a Java routine must have the relevant access privileges on the tables that are used inside the Java method. Once the routine has been defined, the normal database access control applies to its user. The routine can be executed only by those users who have been granted EXECUTE privileges on it. Access to routines can be granted to users with GRANT EXECUTE or GRANT ALL. For example, GRANT EXECUTE ON myroutine TO PUBLIC. In hsqldb 2.7.1, all classes by default are not accessible, except those in java.lang.Math and need to be manually enabled.

🔗 References (39)