drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme Service Registry
Name: |
Mehrere Probleme Service Registry |
|
ID: |
RHSA-2021:2039-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Integration |
|
Datum: |
Mi, 19. Mai 2021, 23:28 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2020-14040
https://access.redhat.com/security/cve/CVE-2020-25638
https://catalog.redhat.com/software/operators/detail/5ef2818e7dc79430ca5f4fd2
https://access.redhat.com/security/cve/CVE-2020-25649 |
|
Applikationen: |
Service Registry |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: Service Registry (container images) release and security update [1.1.1.GA] Advisory ID: RHSA-2021:2039-01 Product: Red Hat Integration Advisory URL: https://access.redhat.com/errata/RHSA-2021:2039 Issue date: 2021-05-19 Keywords: service-registry CVE Names: CVE-2020-14040 CVE-2020-25638 CVE-2020-25649 =====================================================================
1. Summary:
An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Description:
This release of Red Hat Integration - Service registry 1.1.1.GA serves as a replacement for 1.1.0.GA, and includes the below security fixes.
Security Fix(es):
* hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used (CVE-2020-25638)
* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649)
* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
3. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed (https://bugzilla.redhat.com/):
1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used 1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
5. References:
https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/cve/CVE-2020-25638 https://access.redhat.com/security/cve/CVE-2020-25649 https://access.redhat.com/security/updates/classification/#moderate https://catalog.redhat.com/software/operators/detail/5ef2818e7dc79430ca5f4fd2
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYKTGCtzjgjWX9erEAQhLJQ//ZPdV9qQgM3ZomoLBvRSivyr5wKg6R3u9 O9lLqS3fNtC3J9ZS2SvyNKcHM98SNx9b8UXsRsqEgXjHL3eWphTLsFecrsdHsF8z exMiVPyacUhqf8KZgryKsOerrfO7rkNuM7w1UewTWSfC3Tzw29+J3t9Z0Hprjs5Z MdsInSRXVz6v+aRAWhriSSZak6TnpeDwXmz0twvknUpuCVHj9tqkc1dEO1D+itSD 1frJp8cafio7r9WfOJWj1vdypiUmvjESZJh4UR8zhEs8AHeoG+x+65VhFVaFhLQG uiWzyUBENazgz5GMFk5O0VReJs0eftcg6TkVHKbOk7p2mN8C2gLnP/WtlPuDGWZX IBKLuFGPZdAVdqJb6VMtk7uSIQ6PjY5YI0YOW14Gh/KZEGaVwxFJSnW70XTWqXPg aN5MHCaEcWRLV1aQs72A4ZGbCxSAlAVnnxpns0P6W2wzDbSGleZq4BGu+9L0MYtd QdeoGqMh3a3KnNzWxdk5/PuADLYB98DheFTJtxCH6XU5vE38gp80JiKRZtBaD6PE oY1eRJiHdmiz74QDCJUbUN4ToFXUSyixTjhHPrATpXdIrXmFUBB6E8c7CnEBfUr5 r9UIp8BME12owmnXAHdbtcUEGLpvs1wV5Our1g5nYvkteVM+eY5qdglRNqrTT2b2 u9LVCW4VSz0= =7mPt -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|