(RHSA-2023:3667) Moderate: Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update

2023-06-1916:31:18

access.redhat.com

red hat

integration

camel extensions

quarkus

security update

cve-2023-1436

uncontrolled recursion

jsonarray

cve-2021-37533

ftp client

pasv response

security fix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

65.8%

JSON

A security update for Camel Extensions for Quarkus 2.13.3 is now available. The purpose of this text-only errata is to inform you about the security issues fixed.
Red Hat Product Security has rated this update as having an impact of Important.

A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Security Fix(es):

CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray
CVE-2021-37533 apache-commons-net: FTP client trusts the host from PASV response by default