title: Red Hat Security Advisory: Red Hat Data Grid 8.3.0 security update
description: wildfly-elytron: possible timing attack in ScramServer XStream: remote command execution attack by manipulating the processed input stream netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue netty: control chars in header names may lead to HTTP request smuggling
cpes: cpe:/a:redhat:jboss_data_grid:8