title: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
description: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) keycloak: auth permitted with expired certs in SAML client keycloak: infinite loop in session replacement leading to denial of service jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class bouncycastle: flaw in the low-level interface to RSA key pair generator
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0