Red Hat Security Advisory: Red Hat Fuse 7.8.0 release and security update
jackson-modules-java8: DoS due to an Improper Input Validation thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol mysql-connector-java: privilege escalation in MySQL connector spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities hibernate-validator: safeHTML validator allows XSS AngularJS: Prototype pollution in merge function could result in code injection org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId libquartz: XXE attacks via job description hibernate: SQL injection issue in Hibernate ORM batik: SSRF via "xlink:href" jetty: double release of resource can lead to information disclosure Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain tika: excessive memory usage in PSDParser apache-flink: JMX information disclosure vulnerability springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack cryptacular: excessive memory allocation during a decode operation nodejs-angular: XSS due to regex-based HTML replacement log4j: improper validation of certificate with host mismatch in SMTP appender tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers dom4j: XML External Entity vulnerability in default SAX parser wildfly: unsafe deserialization in Wildfly Enterprise Java Beans netty: compression/decompression codecs don't enforce limits on buffer allocation sizes camel: DNS Rebinding in JMX Connector could result in remote command execution camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution camel: Netty enables Java deserialization by default which could leed to remote code execution karaf: A remote client could create MBeans from arbitrary URLs shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass camel: server-side template injection and arbitrary file disclosure on templating components postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML shiro: specially crafted HTTP request may cause an authentication bypass RESTEasy: Caching routes in RootNode may result in DoS
cpe:/a:redhat:jboss_fuse:7