Red Hat build of Apache Camel 4.4.1 for Spring Boot release and security update
 is now available.

Red Hat Product Security has rated this update as having a security impact of
 Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat build of Apache Camel 4.4.1 for Spring Boot release and security update
 is now available.

The purpose of this text-only errata is to inform you about the security issues
 fixed.

Security Fix(es):

* undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket
 (CVE-2024-5971)

* pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using
 PreferQueryMode=SIMPLE (CVE-2024-1597)

* vert.x: io.vertx/vertx-core: memory leak due to the use of Netty
 FastThreadLocal data structures in Vertx (CVE-2024-1023)

* vertx-core: io.vertx:vertx-core: memory leak when a TCP server is configured
 with TLS and SNI supportd (CVE-2024-1300)

* undertow: url-encoded request path information can be broken on ajp-listener
 (CVE-2024-6162)

* jetty: stop accepting new connections from valid clients (CVE-2024-22201)

* threetenbp: null pointer exception (CVE-2024-23081)

* org.bouncycastle:bcprov-jdk18on: org.bouncycastle: Importing an EC
 certificate with crafted F2m parameters may lead to Denial of Service (CVE-2024-29857)

* org.bouncycastle-bcprov-jdk18on: bc-java: BouncyCastle vulnerable to a timing
 variant of Bleichenbacher (Marvin Attack) (CVE-2024-30171)

* org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the
 ScalarUtil class (CVE-2024-30172)

* mvel: TimeOut error when calling ParseTools.subCompileExpression() function
 (CVE-2023-51079)

For more details about the security issue(s), including the impact, a CVSS
 score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-51079
CVE-2024-1023: Improper Restriction of Operations within the Bounds of a Memory
 Buffer (CWE-119)
CVE-2024-1300: Uncontrolled Resource Consumption (CWE-400)
CVE-2024-1597: Improper Neutralization of Special Elements used in an SQL
 Command ('SQL Injection') (CWE-89)
CVE-2024-5971: Uncontrolled Recursion (CWE-674)
CVE-2024-6162: Uncontrolled Resource Consumption (CWE-400)
CVE-2024-22201: Uncontrolled Resource Consumption (CWE-400)
CVE-2024-23081: Improper Check for Unusual or Exceptional Conditions (CWE-754)
CVE-2024-29857: Improper Input Validation (CWE-20)
CVE-2024-30171: Observable Timing Discrepancy (CWE-208)
CVE-2024-30172: Loop with Unreachable Exit Condition ('Infinite Loop')
 (CWE-835)