RHSA-2023:7247CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat Fuse 7.12.1 release and security update

Published
November 15, 2023
Last Modified
August 18, 2026

🔗 CVE IDs covered (13)

CVE-2023-3223 →CVE-2023-3635 →CVE-2023-34034 →CVE-2023-40167 →CVE-2023-41900 →CVE-2023-46604 →CVE-2023-36478 →CVE-2023-36479 →CVE-2023-39410 →CVE-2023-42794 →CVE-2023-42795 →CVE-2023-44487 →CVE-2023-45648 →

📋 Description

CVE-2023-3223 — undertow: OutOfMemoryError due to @MultipartConfig handling CVE-2023-3635 — okio: GzipSource class improper exception handling CVE-2023-34034 — spring-security-webflux: path wildcard leads to security bypass CVE-2023-36478 — jetty: hpack header values cause denial of service in http/2 CVE-2023-36479 — jetty: Improper addition of quotation marks to user inputs in CgiServlet CVE-2023-39410 — apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2023-40167 — jetty: Improper validation of HTTP/1 content-length CVE-2023-41900 — jetty: OpenId Revoked authentication allows one request CVE-2023-42794 — tomcat: FileUpload: DoS due to accumulation of temporary files on Windows CVE-2023-42795 — tomcat: improper cleaning of recycled objects could lead to information leak CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) CVE-2023-45648 — tomcat: incorrectly parsed http trailer headers can cause request smuggling CVE-2023-46604 — activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

🎯 Affected products1

  • Red Hat Fuse 7.12.1

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Users of path-based URL determination should ensure that all their patterns have a slash prepended. example: pathMatchers("home/**") // vulnerable pathMatchers("/home/**") // not vulnerable Workaround: No mitigations are currently available for this vulnerability. Workaround: No mitigation is currently available for this flaw. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: In affected systems, it may be possible to mitigate some of the risks from this vulnerability. However this mitigation cannot eliminate all risks; the only complete resolution is to apply software updates. On systems where the broker is exposed to the public network, use firewall rules to restrict the transport ports and enable SSL to protect this "Transport".

🔗 References (18)