(RHSA-2022:6407) Moderate: Red Hat Integration Camel-K 1.8 security update

A minor version update is now available for Red Hat Camel K that includes CVE fixes in the base images, which are documented in the Release Notes document linked in the References section.

Security Fix(es):

• hadoop: WebHDFS client might send SPNEGO authorization header (CVE-2020-9492)

• jetty: request containing multiple Accept headers with a large number of “quality” parameters may lead to DoS (CVE-2020-27223)

• jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

• mysql-connector-java: unauthorized access to critical (CVE-2021-2471)

• lz4: memory corruption due to an integer overflow bug caused by memmove argument (CVE-2021-3520)

• undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

• elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure (CVE-2021-22132)

• jetty: Symlink directory exposes webapp directory contents (CVE-2021-28163)

• jetty: Ambiguous paths can access WEB-INF (CVE-2021-28164)

• jetty: Resource exhaustion when receiving an invalid large TLS frame (CVE-2021-28165)

• jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

• Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVE-2021-38153)

• xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

• resteasy: Error message exposes endpoint class information (CVE-2021-20289)

• elasticsearch: Document disclosure flaw when Document or Field Level Security is used (CVE-2021-22137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.