Release of OpenShift Serverless Logic 1.33.0
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
This release includes security, bug fixes, and enhancements.
Security Fix(es):
* keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in
checkLoginIframe leads to DDoS (CVE-2024-1249)
* keycloak: XSS via assertion consumer service URL in SAML POST-binding flow
(CVE-2023-6717)
* pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using
PreferQueryMode=SIMPLE (CVE-2024-1597)
* camel-core: Exposure of sensitive data by crafting a malicious EventFactory
(CVE-2024-22371)
* commons-compress: Denial of service caused by an infinite loop for a
corrupted DUMP file (CVE-2024-25710)
* commons-compress: OutOfMemoryError unpacking broken Pack200 file
(CVE-2024-26308)
* jose4j: denial of service via specially crafted JWE (CVE-2023-51775)
For more details about the security issues, including the impact, a CVSS score,
acknowledgements, and other related information, refer to the CVE pages listed in the References section.
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2023-6717: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting') (CWE-79)
CVE-2023-51775: Uncontrolled Resource Consumption (CWE-400)
CVE-2024-1249: Origin Validation Error (CWE-346)
CVE-2024-1597: Improper Neutralization of Special Elements used in an SQL
Command ('SQL Injection') (CWE-89)
CVE-2024-22371: Insertion of Sensitive Information Into Sent Data (CWE-201)
CVE-2024-25710: Loop with Unreachable Exit Condition ('Infinite Loop')
(CWE-835)
CVE-2024-26308: Allocation of Resources Without Limits or Throttling (CWE-770)
|
