title: Red Hat Security Advisory: rhvm-appliance security update
description: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) postgresql: Certain host connection parameters defeat client-side security defenses bouncycastle: flaw in the low-level interface to RSA key pair generator
cpes: cpe:/o:redhat:enterprise_linux:7::hypervisor