title: Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update
description: jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name apache-httpclient: incorrect handling of malformed authority component in request URIs undertow: Server identity in https connection is not checked by the undertow client Moment.js: Path traversal  in moment.locale spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security hazelcast: Hazelcast connection caching batik: Server-Side Request Forgery batik: Server-Side Request Forgery batik: Server-Side Request Forgery (SSRF) vulnerability batik: Apache XML Graphics Batik vulnerable to code execution via SVG dev-java/snakeyaml: DoS via stack overflow codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS engine.io: Specially crafted HTTP request can trigger an uncaught exception postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow batik: Untrusted code execution in Apache XML Graphics Batik Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing tomcat: JsonErrorReportValve injection CXF: directory listing / code exfiltration CXF: SSRF Vulnerability Undertow: Infinite loop in SslConduit during close json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern springframework: Spring Expression DoS Vulnerability spring-boot: Spring Boot Welcome Page DoS Vulnerability shiro: Authentication bypass through a specially crafted HTTP request bouncycastle: potential  blind LDAP injection attack using a self-signed certificate
cpes: cpe:/a:redhat:jboss_fuse:7