RHSA-2024:1353HighCVSS 7.5

Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.5 security update

Published
March 18, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (11)

CVE-2022-1471 →CVE-2022-44729 →CVE-2022-44730 →CVE-2023-0482 →CVE-2023-3635 →CVE-2023-5072 →CVE-2023-6717 →CVE-2023-33201 →CVE-2022-40151 →CVE-2022-41966 →CVE-2023-6481 →

📋 Description

CVE-2022-1471 — SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-40151 — xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-41966 — xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow CVE-2022-44729 — batik: Server-Side Request Forgery vulnerability CVE-2022-44730 — batik: Server-Side Request Forgery vulnerability CVE-2023-0482 — RESTEasy: creation of insecure temp files CVE-2023-3635 — okio: GzipSource class improper exception handling CVE-2023-5072 — JSON-java: parser confusion leads to OOM CVE-2023-6481 — logback: A serialization vulnerability in logback receiver CVE-2023-6717 — keycloak: XSS via assertion consumer service URL in SAML POST-binding flow CVE-2023-33201 — bouncycastle: potential blind LDAP injection attack using a self-signed certificate

🎯 Affected products1

  • RHPAM 7.13.5 async

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No current mitigation is available for this flaw. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)