Security Bulletin: Security vulnerabilities have been identified in IBM HTTP Server used by WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2020-13938, CVE-2021-30641)

Summary IBM HTTP Server used by WebSphere Application Server is/are shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM HTTP Server used by WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer ...

com.github.seratch:jslack-lightning-micronaut (>=3.1.1, <=3.4.2), net.javacrumbs.shedlock:shedlock-micronaut (>=4.0.0, <=4.8.0) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.2.6)

io.micronaut:micronaut-http-server-netty MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.github.seratch:jslack-lightning-micronaut =3.1.1, =4.0.0, =4.8.0 Source cve...

com.slack.api:bolt-micronaut (>=1.0.9, <=1.0.11) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.6)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =1.0.9, =1.0.11 Source cves: CVE-2021-32769 Source...

com.slack.api:bolt-micronaut (1.0.8), info.novatec:micronaut-camunda-bpm-feature (0.3.1) +8 more potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.5)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 1.0.8 - info.novatec:micronaut-camunda-bpm-feature...

com.bertramlabs.plugins:asset-pipeline-micronaut (3.0.7) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.0.1)

io.micronaut:micronaut-http-server-netty MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut 3.0.7 Source cves:...

org.ryoframework.core:ryo-application-micronaut (>=1.0.3, <=1.0.9), org.ryoframework.next:ryo-adapter-micronaut (1.0.0) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.1.0)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut =1.0.3, =1.0.9 -...

org.ryoframework.core:ryo-application-micronaut (1.1.0) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.1.1)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut 1.1.0 Source cves: CVE-2021-327...

org.ryoframework.core:ryo-application-micronaut (>=1.1.1, <=1.3.1) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.1.2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut =1.1.1, =1.3.1 Source cves:...

com.slack.api:bolt-micronaut (0.99.0) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.0)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 0.99.0 Source cves: CVE-2021-32769 Source advisory...

com.slack.api:bolt-micronaut (>=0.99.1, <=1.0.2) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =0.99.1, =1.0.2 Source cves: CVE-2021-32769 Source...

com.slack.api:bolt-micronaut (>=1.0.3, <=1.0.6), info.novatec:micronaut-camunda-bpm-feature (>=0.1.0, <=0.2.2) +2 more potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.3)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =1.0.3, =0.1.0, =1.0.0.rc1, =1.0.0.rc2 -...

com.slack.api:bolt-micronaut (1.0.7), net.javacrumbs.shedlock:shedlock-micronaut (>=4.9.0, <=4.12.0) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.3.4)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 1.0.7 - net.javacrumbs.shedlock:shedlock-micronaut...

br.com.zup.beagle:beagle-micronaut-starter (>=1.1.0, <=2.1.0), com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.3.1, <=4.3.0) +12 more potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (>=2.0.0, <=2.5.8)

io.micronaut:micronaut-http-server-netty MAVEN version =2.0.0, =1.1.0, =3.3.1, =1.1.0, =1.3.12, =0.5.0, =2.1.0, =4.13.0, =0.1.0, =0.1.3 - pl.coderion:openfoodfacts-java-wrapper 0.9.3 Source cves: CVE-2021-32769 Source advisory: OSV:GHSA-CJX7-399X-P2RJ...

com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.0.9, <=3.2.5) potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (1.1.0.m2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut =3.0.9, =3.2.5 Source cves:...

br.com.zup.beagle:beagle-micronaut-starter (>=1.1.0, <=2.1.0), com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.3.1, <=4.3.0) +12 more potentially affected by CVE-2021-32769 via io.micronaut:micronaut-http-server-netty (>=2.0.0, <=2.5.8)

io.micronaut:micronaut-http-server-netty MAVEN version =2.0.0, =1.1.0, =3.3.1, =1.1.0, =1.3.12, =0.5.0, =2.1.0, =4.13.0, =0.1.0, =0.1.3 - pl.coderion:openfoodfacts-java-wrapper 0.9.3 Source cves: CVE-2021-32769 Source advisory: GHSA-CJX7-399X-P2RJ...

CVE-2021-32792

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, there is an XSS vulnerability in when using OIDCPreservePost ...

CVE-2021-32791

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, the AES GCM encryption in modauthopenidc uses a static IV and...

CVE-2021-32786

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers...

CVE-2021-32786

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers...

CVE-2021-32786

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers...