title: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update
description: elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure tomcat: deserialization flaw in session persistence storage leading to RCE junit4: TemporaryFolder is shared between all users across system which could result in information disclosure wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure jackson-databind: denial of service via a large depth of nested objects mysql-connector-java: unauthorized access to critical undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes undertow: client side invocation timeout raised when calling over HTTP2 kubernetes-client: Insecure deserialization in unmarshalYaml method springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) springframework: malicious input leads to insertion of additional log entries spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request protobuf-java: potential DoS in the parsing procedure for binary data google-oauth-client: Token signature not verified tomcat: Information disclosure when using NTFS file system tomcat: Request mix-up with h2c tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence) XStream: remote command execution attack by manipulating the processed input stream tomcat: JNDI realm authentication weakness tomcat: HTTP request smuggling when used with a reverse proxy jdom: XXE allows attackers to cause a DoS via a crafted HTTP request apache-commons-compress: infinite loop when reading a specially crafted 7Z archive apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients xml-security: XPath Transform abuse allows for information disclosure tomcat: Infinite loop while reading an unexpected TLS packet when using OpenSSL JSSE engine karaf: insecure java deserialization tomcat: OutOfMemoryError caused by HTTP upgrade connection leak could lead to DoS logback: remote code execution through JNDI call from within its configuration file netty: control chars in header names may lead to HTTP request smuggling xstream: Injecting highly recursive collections or maps can cause a DoS xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629) undertow: Double AJP response for 400 from EAP 7 results in CPING failures mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes karaf: path traversal flaws spring-expression: Denial of service via specially crafted SpEL expression Framework: Data Binding Rules Vulnerability springframework: DoS via data binding to multipartFile or servlet part springframework: DoS with STOMP over WebSocket springframework: BCrypt skips salt rounds for work factor of 31 springframework: Authorization Bypass in RegexRequestMatcher tomcat: local privilege escalation vulnerability h2: Loading of custom classes from remote servers through JNDI junrar: A carefully crafted RAR archive can trigger an infinite loop while extracting artemis-commons: Apache ActiveMQ Artemis DoS metadata-extractor: Out-of-memory when reading a specially crafted JPEG file fastjson: autoType shutdown restriction bypass leads to deserialization poi-scratchpad: A carefully crafted TNEF file can cause an out of memory exception postgresql-jdbc: Arbitrary File Write Vulnerability tika-core: Regular Expression Denial of Service in standards extractor
cpes: cpe:/a:redhat:jboss_fuse:7