RHSA-2024:3708HighCVSS 9.8

Red Hat Security Advisory: Red Hat Build of Apache Camel 3.20.6 for Spring Boot security update.

Published
June 6, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2023-44483 →CVE-2024-22257 →CVE-2024-22262 →CVE-2024-28752 →CVE-2022-34169 →CVE-2022-45685 →

📋 Description

CVE-2022-34169 — OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) CVE-2022-45685 — jettison: stack overflow in JSONObject() allows attackers to cause a Denial of Service (DoS) via crafted JSON data CVE-2023-44483 — santuario: Private Key disclosure in debug-log output CVE-2024-22257 — spring-security: Broken Access Control With Direct Use of AuthenticatedVoter CVE-2024-22262 — springframework: URL Parsing with Host Validation CVE-2024-28752 — cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

🎯 Affected products1

  • Red Hat build of Apache Camel 3.20.6 for Spring Boot

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available for this vulnerability. Please make sure to update as the fixes become available.

🔗 References (8)