An update to the images for Red Hat Integration - Service Registry is now
 available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release.

Red Hat Product Security has rated this update as having a security impact of
 Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

This release of Red Hat Integration - Service Registry 2.5.4 GA includes the
 following security fixes.

Security Fix(es):

* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a
 DDoS attack (Rapid Reset Attack) [rhint-serv-2] (CVE-2023-44487)

* quarkus-vertx-http: quarkus: HTTP security policy bypass [rhint-serv-2] (CVE-2023-4853)

* netty: SniHandler 16MB allocation leads to OOM [rhint-serv-2]
 (CVE-2023-34462)

* snappy-java: Unchecked chunk length leads to DoS [rhint-serv-2]
 (CVE-2023-34455)

* quarkus-oidc: ID and access tokens leak via the authorization code flow
 [rhint-serv-2] (CVE-2023-1584)

For more details about the security issue(s), including the impact, a CVSS
 score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-1584: Exposure of Sensitive Information to an Unauthorized Actor
 (CWE-200)
CVE-2023-4853: Improper Neutralization of Input Leaders (CWE-148)
CVE-2023-34455: Improper Validation of Specified Index, Position, or Offset in
 Input (CWE-1285)
CVE-2023-34462: Allocation of Resources Without Limits or Throttling (CWE-770)
CVE-2023-44487: Uncontrolled Resource Consumption (CWE-400)