-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Integration - Service Registry release and security update [2.0.2.GA] Advisory ID: RHSA-2021:4100-01 Product: Red Hat Integration Advisory URL: https://access.redhat.com/errata/RHSA-2021:4100 Issue date: 2021-11-02 Keywords: service-registry CVE Names: CVE-2020-13956 CVE-2021-20289 CVE-2021-20293 ===================================================================== 1. Summary: An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Integration - Service registry 2.0.2.GA serves as a replacement for 2.0.1.GA, and includes the below security fixes. Security Fix(es): * apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956) * RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack (CVE-2021-20293) * resteasy: Error message exposes endpoint class information (CVE-2021-20289) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 1886587 - CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs 1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information 1942819 - CVE-2021-20293 RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack 5. References: https://access.redhat.com/security/cve/CVE-2020-13956 https://access.redhat.com/security/cve/CVE-2021-20289 https://access.redhat.com/security/cve/CVE-2021-20293 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYEyVtzjgjWX9erEAQinrA//WUo0zL0uDp5i0UDqGiqleOUd74mlJvsC UTzcXp179a9PDtMU0HD7SpPQMOHue+x8VYxpL4ETe5wxLshXjQ92WRiRViIJEVYO tBMVPNU7ytMhFrzjNJfyQHl+hbxwaVHTFWEB74SeCiHDK8LxyKNkFucG9l0lCbCR D6ZmKptHG/ROdZ6mBSTI3un9Y8ZJVSDSyUilZJtOORndDswbzdk/ArAhOLtEDZoo KPpOM0Xfw8YIanpJZ0sA4mputxh52+cJ2J17LMr4iiPW5bEOntplGlmsXTdJgyUg gaj/xDPGFwa+ugIjT0xG+l0vsGWTFHILvHhtQgGJ737FJNY2xsFxzNIyOI0DU6Ez HTHw6/QOFYj5svQz1CwQZLS7EoiytYpUuJz9iLM8SbUASnW2pO4/N1FTzfePle5H nxRDT1QdNr4rwRudqxF2zKyBl9nMTyJydEM7qbhP3ZoD7+ks0M1USdLSCjuQni7I j2y7ri9dimADgRRXAMdooAZFKcvQaHthyo5cbT5bS+vQyadxOFtEjkxn16j4+Fp5 AOl26kcUxfv6mERzm2r9j+T891YYqvW+TSRoFJ9fVUTsFjcBctyha1gpcm5+BuIt 8nUFFziKqXHXlTbtoyOgI4R11QjL+qV1U6gKQtqPQuCvVOcfW11g1eSNUhKvgNWk HFWIwhJW/3o= =I1Oq -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce