RHSA-2024:3354HighCVSS 9.8

Red Hat Security Advisory: Red Hat Fuse 7.13.0 release and security update

Published
May 23, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (18)

CVE-2023-36478 →CVE-2024-22243 →CVE-2023-3223 →CVE-2023-6378 →CVE-2023-34055 →CVE-2023-36479 →CVE-2023-39410 →CVE-2023-40167 →CVE-2024-21733 →CVE-2022-41678 →CVE-2023-5072 →CVE-2023-46589 →CVE-2023-46749 →CVE-2023-50290 →CVE-2023-6481 →CVE-2024-1635 →CVE-2024-22257 →CVE-2024-28752 →

📋 Description

CVE-2022-41678 — ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE CVE-2023-3223 — undertow: OutOfMemoryError due to @MultipartConfig handling CVE-2023-5072 — JSON-java: parser confusion leads to OOM CVE-2023-6378 — logback: serialization vulnerability in logback receiver CVE-2023-6481 — logback: A serialization vulnerability in logback receiver CVE-2023-34055 — spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service CVE-2023-36478 — jetty: hpack header values cause denial of service in http/2 CVE-2023-36479 — jetty: Improper addition of quotation marks to user inputs in CgiServlet CVE-2023-39410 — apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2023-40167 — jetty: Improper validation of HTTP/1 content-length CVE-2023-46589 — tomcat: HTTP request smuggling via malformed trailer headers CVE-2023-46749 — shiro: path traversal attack may lead to authentication bypass CVE-2023-50290 — Solr: Host environment variables are published via the Metrics API CVE-2024-1635 — undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol CVE-2024-21733 — tomcat: Leaking of unrelated request bodies in default error page CVE-2024-22243 — springframework: URL Parsing with Host Validation CVE-2024-22257 — spring-security: Broken Access Control With Direct Use of AuthenticatedVoter CVE-2024-28752 — cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

🎯 Affected products1

  • Red Hat Fuse 7.13.0

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No current mitigation is available for this flaw. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigations are currently available for this vulnerability. Workaround: This flaw can be mitigated by making sure 'blockSemicolon' is enabled. Workaround: No mitigation is currently available for this vulnerability. However, there might be some protections, such as request limits by a load balancer in front of JBoss EAP/Wildfly or even Undertow, that could minimize the impact. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: No mitigation is currently available for this vulnerability. Please make sure to update as the fixes become available.

🔗 References (18)