Moderate: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.18.3 release and security update

A minor version update from 3.14.5 to 3.18.3 is now available for Camel for Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9

Summary IBM Data Risk Manager IDRM 2.0.6.14, which is the only supported version, is impacted by multiple vulnerabilities including Apache Commons Text 1.9 CVE-2022-42889. The vulnerabilities have been addressed in the updated version of IDRM 2.0.6.15 which includes Apache Commons Text 1.10. Plea...

Exploit for Code Injection in Apache Commons_Text

Text4shell-exploit This is a Proof of Concept exploiting the v...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

SUSE SLES12 Security Update : bcel (SUSE-SU-2022:4331-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:4331-1 advisory. - CVE-2022-42920: Fixed producing arbitrary bytecode via out-of-bounds writing bsc1205125. Tenable has extracted the preceding description...

Information Disclosure

commons-net is vulnerable to information disclosure. The vulnerability exists because the parsePassiveModeReply function of FTPClient.java trusts the host from the PASV response by default, allowing an attacker to gain sensitive information by redirecting to the malicious host URLs...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities including those in Node.js, swagger, jQuery, Netty, Apache commons, validator.js, Chalk ansi-regex, Json-schema, Java SE and IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2021-4453...

Security Bulletin: Multiple Security Vulnerabilities Affect IBM Cloud Transformation Advisor

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities. Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a...

Apache Commons Net < 3.9.0 Information Disclosure Vulnerability

The Apache Commons Net library is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-CGP8-4M63-FHH5 Apache Commons Net vulnerable to information leakage via malicious server

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about...

Apache Commons Net vulnerable to information leakage via malicious server

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about...

io.github.gferrariuy:axis-rt-transport-mail (1.4.1.1), io.github.gferrariuy:axis1-maintained (1.4.1.1) +1 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.0.0)

commons-net:commons-net MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - io.github.gferrariuy:axis-rt-transport-mail 1.4.1.1 - io.github.gferrariuy:axis1-maintained 1.4.1.1 -...

maven:maven-artifact-plugin (>=1.4, <=1.6), maven:maven-site-plugin (>=1.5.1, <=1.6) +5 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.1.0)

commons-net:commons-net MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - maven:maven-artifact-plugin =1.4, =1.5.1, =1.0-alpha-2, =2.9.0-b03, =0.0.1, =20040825.211642, =20040825.214656...

maven:maven-announcement-plugin (1.3) potentially affected by CVE-2021-37533 via commons-net:commons-net (1.2.1)

commons-net:commons-net MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - maven:maven-announcement-plugin 1.3 Source cves: CVE-2021-37533 Source advisory: OSV:GHSA-CGP8-4M63-FHH5...

com.github.yungyu16.toolkit:toolkit-common (1.0.0), com.github.yungyu16.toolkit:toolkit-core (>=1.0.3, <=3.0.0) +1 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.2.2)

commons-net:commons-net MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - com.github.yungyu16.toolkit:toolkit-common 1.0.0 - com.github.yungyu16.toolkit:toolkit-core =1.0.3, =1.0.4, =3.0....

acegisecurity:acegi-security (>=0.8.2, <=0.9.0), acegisecurity:acegi-security-cas (0.9.0) +33 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.3.0)

commons-net:commons-net MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - acegisecurity:acegi-security =0.8.2, =0.3, =0.3, =0.7, =0.9.0 - directory-protocols:kerberos-protocol 0.4 -...

com.github.goldin:about-maven-plugin (>=0.2.4, <=0.2.5), com.github.goldin:assert-maven-plugin (>=0.2.4, <=0.2.5) +36 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.4.0)

commons-net:commons-net MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - com.github.goldin:about-maven-plugin =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4,...

ai.djl.hadoop:hadoop (>=0.6.0, <=0.12.0), br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2) +897 more potentially affected by CVE-2021-37533 via commons-net:commons-net (1.4.1)

commons-net:commons-net MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - ai.djl.hadoop:hadoop =0.6.0, =1.2.1, =1.0.0, =1.0.0, =0.2.3, =5.1.0-hbase-2.0, =1.6, =1.18.0-geaflow1.0, =2.0.0,...

br.com.anteros:anteros-sms (1.0.0), br.gov.frameworkdemoiselle.component.behave:demoiselle-behave-regression-report (>=1.5.2-beta1, <=1.6.0-beta2) +496 more potentially affected by CVE-2021-37533 via commons-net:commons-net (2.0)

commons-net:commons-net MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-net:commons-net and may be impacted: - br.com.anteros:anteros-sms 1.0.0 - br.gov.frameworkdemoiselle.component.behave:demoiselle-behave-regression-report...