Red Hat JBoss Data Grid: Mehre Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.8
  CVE-2022-45047 Public exploit

  Apache MINA SSHD: Java unsafe deserialization vulnerability

  Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-core org.apache.sshd:sshd-common Maven
  Nov 16, 2022
• Medium 6.5
  CVE-2023-34462

  netty-handler SniHandler 16MB allocation

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

  netty netty netty netty Debian Ubuntu Wolfi Maven
  Jun 22, 2023
• Medium 6.5
  CVE-2023-3628

  Infispan: rest bulk ops don't check permissions

  A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

  Red Hat Red Hat JBoss Enterprise Application Platform 6 Red Hat Data Grid 8.4.4 org.infinispan:infinispan-server-rest Maven
  Dec 18, 2023
• Medium 5.0
  CVE-2023-35887 Public exploit

  Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

  Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-common Wolfi Maven
  Jul 10, 2023
• Medium 4.4
  CVE-2023-5236

  Infinispan: circular reference on marshalling leads to dos

  A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors an…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Maven
  Dec 18, 2023
• Medium 4.3
  CVE-2023-3629

  Infinispan: non-admins should not be able to get cache config via rest api

  A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

  Red Hat Red Hat JBoss Enterprise Application Platform 6 Red Hat Data Grid 8.4.4 org.infinispan:infinispan-server-rest Maven
  Dec 18, 2023
• Unscored —
  CVE-2023-35116

  jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted…

  Jun 14, 2023

Revision history

1. 2024-07-01 #11

   Neue Updates von HITACHI aufgenommen

2. 2024-03-06 #10

   Neue Updates von Red Hat aufgenommen

3. 2024-01-25 #9

   Neue Updates von NetApp aufgenommen

4. 2024-01-17 #8

   Neue Updates von IBM aufgenommen

5. 2024-01-10 #7

   Neue Updates von Red Hat aufgenommen

6. 2023-12-07 #6

   Neue Updates von Red Hat aufgenommen

7. 2023-12-05 #5

   Neue Updates von Red Hat aufgenommen

8. 2023-12-04 #4

   Neue Updates von Red Hat aufgenommen

9. 2023-10-19 #3

   Neue Updates von Red Hat aufgenommen

10. 2023-10-05 #2

    Neue Updates von Red Hat aufgenommen

11. 2023-09-28 #1

    Initiale Fassung

References

• NetApp Security Advisory NTAP-20240125-0004 vom 2024-01-25
  https://security.netapp.com/advisory/ntap-20240125-0004/
• Red Hat Security Advisory RHSA-2024:0148 vom 2024-01-10
  https://access.redhat.com/errata/RHSA-2024:0148
• Red Hat Security Advisory RHSA-2024:1192 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1192
• Red Hat Security Advisory RHSA-2024:1193 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1193
• Red Hat Security Advisory RHSA-2024:1194 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1194
• IBM Security Bulletin 7108821 vom 2024-01-17
  https://www.ibm.com/support/pages/node/7108821
• Red Hat Security Update vom 2023-09-28
  https://access.redhat.com/errata/RHSA-2023:5396
• Proof of Concept (PoC) für CVE-2023-35116
  https://github.com/FasterXML/jackson-databind/issues/3972
• Red Hat Security Advisory RHSA-2023:5484 vom 2023-10-05
  https://access.redhat.com/errata/RHSA-2023:5484
• Red Hat Security Advisory RHSA-2023:5488 vom 2023-10-05
  https://access.redhat.com/errata/RHSA-2023:5488
• Red Hat Security Advisory RHSA-2023:5486 vom 2023-10-06
  https://access.redhat.com/errata/RHSA-2023:5486
• Red Hat Security Advisory RHSA-2023:5485 vom 2023-10-06
  https://access.redhat.com/errata/RHSA-2023:5485
• Red Hat Security Advisory RHSA-2023:5946 vom 2023-10-20
  https://access.redhat.com/errata/RHSA-2023:5946
• Red Hat Security Advisory RHSA-2023:7641 vom 2023-12-05
  https://access.redhat.com/errata/RHSA-2023:7641
• Red Hat Security Advisory RHSA-2023:7637 vom 2023-12-05
  https://access.redhat.com/errata/RHSA-2023:7637
• Red Hat Security Advisory RHSA-2023:7638 vom 2023-12-05
  https://access.redhat.com/errata/RHSA-2023:7638
• Red Hat Security Advisory RHSA-2023:7639 vom 2023-12-05
  https://access.redhat.com/errata/RHSA-2023:7639
• Red Hat Security Advisory RHSA-2023:7653 vom 2023-12-06
  https://access.redhat.com/errata/RHSA-2023:7653
• Red Hat Security Advisory RHSA-2023:7705 vom 2023-12-08
  https://access.redhat.com/errata/RHSA-2023:7705
• Red Hat Security Advisory RHSA-2023:7697 vom 2023-12-07
  https://access.redhat.com/errata/RHSA-2023:7697
• Hitachi Vulnerability Information HITACHI-SEC-2024-134 vom 2024-07-02
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-134/index.html