title: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update
description: netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl elasticsearch: Information exposure via _cluster/settings API pdfbox: unbounded computation in parser resulting in a denial of service vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. spring-data-jpa: Additional information exposure with Spring Data JPA derived queries HTTP/2: large amount of data requests leads to denial of service hawtio: server side request forgery via initial /proxy/ substring of a URI apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default jackson-mapper-asl: XML external entity similar to CVE-2016-3720 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* cxf: reflected XSS in the services listing page jackson-databind: lacks certain net.sf.ehcache blocking netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header undertow: AJP File Read/Inclusion Vulnerability undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass apache-commons-configuration: uncontrolled class instantiation when loading YAML files netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.JEditorPane jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime jackson-databind: Serialization gadgets in org.springframework:spring-aop jackson-databind: Serialization gadgets in commons-jelly:commons-jelly jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool jackson-databind: serialization in weblogic/oracle-aqjms jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory
cpes: cpe:/a:redhat:jboss_fuse:7