Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled in IBM Cloud Pak for Applications, is vulnerable to denial of service due to GraphQL Java (CVE-2022-37734)

Summary IBM WebSphere Application Server Liberty, which is bundled in IBM Cloud Pak for Applications, is vulnerable to denial of service due to GraphQL Java CVE-2022-37734 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to denial of service due to GraphQL Java (CVE-2022-37734)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to denial of service due to GraphQL Java CVE-2022-37734 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Business Automation Workflow (CVE-2022-37734)

Summary WebSphere Application Server Liberty is shipped as part of IBM Business Automation Workflow containers and as part of the optional components Process Federation Server since 8.5.6, and User Management Service since 18.0.0.1 in IBM Business Automation Workflow traditional. Information abou...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to denial of service due to GraphQL Java (CVE-2022-37734)

Summary There is a vulnerability in the GraphQL Java library used by IBM WebSphere Application Server Liberty with the mpGraphQL-1.0 or mpGraphQL-2.0 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-37734 DESCRIPTION: GraphQL Java is vulnerable to a denial of service...

graphql-java: DoS by malicious query

A flaw was found in GraphQL Java. This flaw allows an attacker to use a malicious query in GraphQL to cause a denial of service due to inefficient lexer input validation...

Important: Red Hat Security Advisory: Service Registry (container images) release and security update [2.3.0.GA]

An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact o...

Important: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.3.3 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

graphql-java: DoS by malicious query

A flaw was found in GraphQL Java. This flaw allows an attacker to use a malicious query in GraphQL to cause a denial of service due to inefficient lexer input validation...

CVE-2022-37734

A flaw was found in GraphQL Java. This flaw allows an attacker to use a malicious query in GraphQL to cause a denial of service due to inefficient lexer input validation...

Denial Of Services (DoS)

graphql-java is vulnerable to denial-of-service. The vulnerability exists because ANTLR lexing and parsing code is taking proportionally longer to get to the max token state which allows a remote attacker to send a malicious GraphQL query that consumes CPU resources resulting in an application...

com.atlassian:nadel (>=2022-03-03t00-44-02-3451c485, <=2022-04-12t23-25-02-db4f6da9), com.atlassian:nadel-api (>=2022-03-03t13-36-24-9b3db244, <=2022-03-22t05-05-01-a5d0b804) +3 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-03-01t04-16-14-e973c9a1)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-03-01t04-16-14-e973c9a1 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-03-03t00-44-02-3451c485,...

com.atlassian:nadel (>=2022-06-20t01-05-08-028f1075, <=2022-08-17t01-51-20-e01ac6d0) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-06-20t00-12-01-bfcc5d95)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-06-20t00-12-01-bfcc5d95 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-06-20t01-05-08-028f1075,...

com.atlassian:nadel (>=2022-01-19t23-18-30-adbad461, <=2022-02-09t22-25-15-f3130aff), com.atlassian:nadel-api (>=2022-01-19t23-18-30-adbad461, <=2022-02-09t22-25-15-f3130aff) +3 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-01-11t23-37-10-2d522ede)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-01-11t23-37-10-2d522ede is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-01-19t23-18-30-adbad461,...

com.atlassian:nadel (>=2022-02-09t22-56-28-545a7ac7, <=2022-02-24t02-45-29-add3d07c), com.atlassian:nadel-api (>=2022-02-09t22-56-28-545a7ac7, <=2022-02-24t02-45-29-add3d07c) +3 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-02-07t22-39-39-39451d5e)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-02-07t22-39-39-39451d5e is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-02-09t22-56-28-545a7ac7,...

com.atlassian:nadel (>=2022-02-24t04-55-10-ea5df0db, <=2022-02-25t06-09-28-d25638d2), com.atlassian:nadel-api (>=2022-02-24t04-55-10-ea5df0db, <=2022-02-25t06-09-28-d25638d2) +3 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-02-23t01-12-39-39fa5820)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-02-23t01-12-39-39fa5820 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-02-24t04-55-10-ea5df0db,...

com.atlassian:nadel (>=2022-05-18t01-58-43-8aeb4e3b, <=2022-06-07t02-15-09-ca2655ea) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-05-17t23-49-21-15a70e59)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-05-17t23-49-21-15a70e59 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-05-18t01-58-43-8aeb4e3b,...

com.atlassian:nadel (2022-06-17t06-26-51-22ef9327) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-06-08t12-24-46-5cac2e36)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-06-08t12-24-46-5cac2e36 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel 2022-06-17t06-26-51-22ef9327 Source cves:...

com.atlassian:nadel (>=2022-10-31t04-06-34-78e1be70, <=2023-03-23t00-25-09-43ae18bf) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2022-10-29t03-41-04-bb4a3b2b)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-10-29t03-41-04-bb4a3b2b is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-10-31t04-06-34-78e1be70,...

com.atlassian:nadel (2023-04-11t00-01-54-ce3f319f) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2023-04-03t05-58-10-976ddbc)

com.graphql-java:graphql-java MAVEN version 0.0.0-2023-04-03t05-58-10-976ddbc is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel 2023-04-11t00-01-54-ce3f319f Source cves:...

com.atlassian:nadel (>=2024-04-24t00-23-23-bc0bf347, <=2024-05-14t06-33-26-da580917) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2024-04-11t03-38-06-0dee00c)

com.graphql-java:graphql-java MAVEN version 0.0.0-2024-04-11t03-38-06-0dee00c is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2024-04-24t00-23-23-bc0bf347,...