Skip to content
OpenAdvisories
High WID-SEC-2023-0864 5 CVEs

Red Hat JBoss A-MQ: Mehrere Schwachstellen

Published Apr 5, 2023 · Updated May 18, 2023 · Revision 3 · de-DE

Vendor: Red Hat Product: Enterprise Linux Product: JBoss A-MQ Product: JBoss A-MQ < 7.10.3 Product: JBoss A-MQ Broker < 7.11.0 Platform: Linux

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.

Product

JBoss A-MQ ist eine Messaging-Plattform.

Vulnerabilities 5

  • Critical 9.1
    CVE-2022-3782 Public exploit

    Keycloak vulnerable to path traversal via double URL encoding

    keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and pote…

    redhat.com Keycloak org.keycloak:keycloak-parent Maven
  • High 7.5
    CVE-2022-1278

    WildFly vulnerable to Insecure Default Initialization of Resource

    A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.

    org.wildfly.bom:wildfly Maven
  • High 7.5
    CVE-2022-22970 Public exploit

    Denial of service in Spring Framework

    In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

    libspring-java libspring-java jenkins org.springframework:spring-beans Debian Ubuntu Alpine Maven
  • Medium 6.5
    CVE-2022-22971 Public exploit

    Allocation of Resources Without Limits or Throttling in Spring Framework

    In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

    libspring-java libspring-java jenkins org.springframework:spring-messaging Debian Ubuntu Alpine Maven
  • Low 2.7
    CVE-2022-2047

    Jetty invalid URI parsing may produce invalid HttpURI.authority

    In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…

    The Eclipse Foundation Eclipse Jetty druid jetty9 Debian Ubuntu Wolfi Maven

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References