Red Hat Security Advisory 2023-3667-01 - A security update for Camel Extensions for Quarkus 2.13.3 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link in the References section.
46f855b61eb9d0f2877fc82bf334c993889f0b94f0a3921324c940b819280f33
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update
Advisory ID: RHSA-2023:3667-01
Product: Red Hat Integration
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3667
Issue date: 2023-06-19
CVE Names: CVE-2021-37533 CVE-2023-1436
=====================================================================
1. Summary:
Red Hat Integration Camel Extensions for Quarkus 2.13.3 release and
security update is now available. The purpose of this text-only errata is
to inform you about the security issues fixed.
Red Hat Product Security has rated this update as having an impact of
Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
2. Description:
A security update for Camel Extensions for Quarkus 2.13.3 is now available.
The purpose of this text-only errata is to inform you about the security
issues fixed.
Red Hat Product Security has rated this update as having an impact of
Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Security Fix(es):
* CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray
* CVE-2021-37533 apache-commons-net: FTP client trusts the host from
PASV response by default
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed (https://bugzilla.redhat.com/):
2169924 - CVE-2021-37533 apache-commons-net: FTP client trusts the host from PASV response by default
2182788 - CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray
5. References:
https://access.redhat.com/security/cve/CVE-2021-37533
https://access.redhat.com/security/cve/CVE-2023-1436
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/cve-2023-1436
https://access.redhat.com/security/cve/cve-2021-37533
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIUAwUBZJCi1dzjgjWX9erEAQhWAg/4syBLRrvw0W32wjD5+839JAqM2d3Y0GFc
zvwz0qBvx07pXZD2ZxMP4vHU56nSQp9sWRVCBZ8Cm2/zleM9bNh8REutNVHnyKgG
sruTkXheoAF2D3Qb8xAYlJi3GaJuRKoVC3EwRGHEXJBtT/Q1EyDgkOMDUMbBo7Im
ZETVo/rOZD4gurDr/gCKWmiCX5UtIXpFlMn3heoPJdb7gvQZ4U1b34og/9znJXFv
i8m1mmtmHqJaSFSYGtl4uYnaGCCV/OQLJ3bcWXMUiK20bHW0xCwOd2BHjKcFLvql
9rAH91e7CXTLPZCGMvyYWE6/i4svcEIuvYRn63/r6VyfXeo+rQ0afCmCcw1XCARW
rvF+P16pBdSe39BpFXSP57ZT6X7Ol0ws9eTurwGB/2R84rCKRg9vGGG6tIRxR0gp
YS9zxs0xm9eg5fucJhyadkEK560fiLiVme9OjqFk9HC/WgZVIlj1JMC5jUTeP4O3
wlGAxot0r1UJ+jOKkuRlq56ShC3s8Lr+D/fy6VbzjcoSwynKTymaMKFH0HROg2yA
IqRBQ0f/N9JezTlhMCIRLLkARGfSsYqwe4G8+xDPu3cUpsypDEd0zUxpq8v4bmR4
dUxSdezolr3EOf7zvJq22MDqh4dZmI08MPwSW0TLV2QT1HuZ7CgmvY5Y5dl4hjW1
eaTV5m7hrw==
=gLY0
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce