{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus. \nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability. For\nmore information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.8.6.SP1 contains security updates. For more information, see the release notes\npage listed in the References section.\n\nSecurity Fix(es):\n\n* com.google.protobuf/protobuf: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)\n\n* org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)\n\n* com.graphql-java.graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java (CVE-2024-40094)\n\n* org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE) (CVE-2024-47561)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7670",
        "url": "https://access.redhat.com/errata/RHSA-2024:7670"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.8",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.8"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/4966181",
        "url": "https://access.redhat.com/articles/4966181"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7670.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.8.6.SP1 Security Update",
    "tracking": {
      "current_release_date": "2026-06-29T23:05:08+00:00",
      "generator": {
        "date": "2026-06-29T23:05:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2024:7670",
      "initial_release_date": "2024-10-10T11:49:18+00:00",
      "revision_history": [
        {
          "date": "2024-10-10T11:49:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-10T11:49:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-29T23:05:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.8",
                "product": {
                  "name": "Red Hat build of Quarkus 3.8",
                  "product_id": "Red Hat build of Quarkus 3.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44549",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-10-01T01:34:34.576000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315808"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Sling Commons Messaging Mail(angus-mail), which provides a simple interface for sending emails via SMTPS in OSGi, does not offer an option to enable server identity checks, leaving connections vulnerable to \"man-in-the-middle\" attacks and can allow insecure email communication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability should be considered of important severity rather than moderate because it directly impacts the integrity and confidentiality of email communications over SMTPS. By disabling server identity checks, it leaves the communication channel vulnerable to \"man-in-the-middle\" (MITM) attacks, where an attacker could intercept, alter, or eavesdrop on email traffic by impersonating the legitimate mail server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315808",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315808"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549"
        }
      ],
      "release_date": "2023-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T11:49:18+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7670"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication"
    },
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T11:49:18+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7670"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-40094",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-07-30T07:20:08+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in GraphQL Java, affecting versions prior to 21.5. This flaw allows an attacker to perform a denial of service (DoS) attack via introspection queries. The issue arises due to the improper handling of ExecutableNormalizedFields (ENFs), which are not adequately considered during the introspection query process. This issue could lead to resource exhaustion and service disruption under certain conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-40094",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a",
          "url": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/discussions/3641",
          "url": "https://github.com/graphql-java/graphql-java/discussions/3641"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/pull/3539",
          "url": "https://github.com/graphql-java/graphql-java/pull/3539"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5"
        }
      ],
      "release_date": "2024-07-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T11:49:18+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7670"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T11:49:18+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7670"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus. \nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability. For\nmore information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.2.12.SP1 contains security updates. For more information, see the release notes\npage listed in the References section.\n\nSecurity Fix(es):\n\n* com.google.protobuf/protobuf: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)\n\n* org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)\n\n* com.graphql-java.graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java (CVE-2024-40094)\n\n* org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE) (CVE-2024-47561)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7676",
        "url": "https://access.redhat.com/errata/RHSA-2024:7676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7676.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.2.12.SP1 Security Update",
    "tracking": {
      "current_release_date": "2026-06-29T23:05:13+00:00",
      "generator": {
        "date": "2026-06-29T23:05:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2024:7676",
      "initial_release_date": "2024-10-10T13:43:59+00:00",
      "revision_history": [
        {
          "date": "2024-10-10T13:43:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-10T13:43:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-29T23:05:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.2",
                "product": {
                  "name": "Red Hat build of Quarkus 3.2",
                  "product_id": "Red Hat build of Quarkus 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44549",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-10-01T01:34:34.576000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315808"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Sling Commons Messaging Mail(angus-mail), which provides a simple interface for sending emails via SMTPS in OSGi, does not offer an option to enable server identity checks, leaving connections vulnerable to \"man-in-the-middle\" attacks and can allow insecure email communication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability should be considered of important severity rather than moderate because it directly impacts the integrity and confidentiality of email communications over SMTPS. By disabling server identity checks, it leaves the communication channel vulnerable to \"man-in-the-middle\" (MITM) attacks, where an attacker could intercept, alter, or eavesdrop on email traffic by impersonating the legitimate mail server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315808",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315808"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549"
        }
      ],
      "release_date": "2023-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication"
    },
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-40094",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-07-30T07:20:08+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in GraphQL Java, affecting versions prior to 21.5. This flaw allows an attacker to perform a denial of service (DoS) attack via introspection queries. The issue arises due to the improper handling of ExecutableNormalizedFields (ENFs), which are not adequately considered during the introspection query process. This issue could lead to resource exhaustion and service disruption under certain conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-40094",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a",
          "url": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/discussions/3641",
          "url": "https://github.com/graphql-java/graphql-java/discussions/3641"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/pull/3539",
          "url": "https://github.com/graphql-java/graphql-java/pull/3539"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5"
        }
      ],
      "release_date": "2024-07-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Critical.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* CVE-2024-47561 org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE)\n* CVE-2024-7254 com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7972",
        "url": "https://access.redhat.com/errata/RHSA-2024:7972"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "external",
        "summary": "2316116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7972.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1)",
    "tracking": {
      "current_release_date": "2026-06-30T03:18:46+00:00",
      "generator": {
        "date": "2026-06-30T03:18:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2024:7972",
      "initial_release_date": "2024-10-10T14:00:25+00:00",
      "revision_history": [
        {
          "date": "2024-10-10T14:00:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-10T14:00:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T03:18:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                "product": {
                  "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                  "product_id": "Red Hat build of Apache Camel 4 for Quarkus 3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T14:00:25+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7972"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T14:00:25+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7972"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat build of Apache Camel 4.4.3 for Spring Boot release and security update is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Apache Camel 4.4.3 for Spring Boot release and security update is now available.\n\nThe purpose of this text-only errata is to inform you about the security issues fixed.\n\nSecurity Fix(es):\n\n* org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE) (CVE-2024-47561)\n\n* com.nimbusds/nimbus-jose-jwt: large JWE p2c header value causes Denial of Service (CVE-2023-52428)\n\n* org.springframework/spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource (CVE-2024-38816)\n\n* ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` (CVE-2024-45294)\n\n* ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` (CVE-2024-45294)\n\n* ca.uhn.hapi.fhir/org.hl7.fhir.r4: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` (CVE-2024-45294)\n\n* ca.uhn.hapi.fhir/org.hl7.fhir.r5: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` (CVE-2024-45294)\n\n* ca.uhn.hapi.fhir/org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` (CVE-2024-45294)\n\n* org.springframework/spring-web: Spring Framework DoS via conditional HTTP request (CVE-2024-38809)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8064",
        "url": "https://access.redhat.com/errata/RHSA-2024:8064"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2309764",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309764"
      },
      {
        "category": "external",
        "summary": "2310447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
      },
      {
        "category": "external",
        "summary": "2312060",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312060"
      },
      {
        "category": "external",
        "summary": "2314495",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314495"
      },
      {
        "category": "external",
        "summary": "2316116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8064.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4.3 for Spring Boot security update.",
    "tracking": {
      "current_release_date": "2026-07-30T09:56:40+00:00",
      "generator": {
        "date": "2026-07-30T09:56:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2024:8064",
      "initial_release_date": "2024-10-14T15:53:39+00:00",
      "revision_history": [
        {
          "date": "2024-10-14T15:53:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-14T15:53:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T09:56:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel 4.4.3 for Spring Boot",
                "product": {
                  "name": "Red Hat build of Apache Camel 4.4.3 for Spring Boot",
                  "product_id": "Red Hat build of Apache Camel 4.4.3 for Spring Boot",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.4.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-52428",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-09-04T17:02:58.468000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-52428"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-52428",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428"
        }
      ],
      "release_date": "2024-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service"
    },
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-38809",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2024-09-24T20:00:28.839621+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2314495"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Spring Web (org.springframework:spring-web) package. Due to improper ETag prefix validation when the application parses ETags from the `If-Match` or `If-None-Match` request headers, an attacker can trigger a denial of service by sending a maliciously crafted conditional HTTP request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-38809"
        },
        {
          "category": "external",
          "summary": "RHBZ#2314495",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314495"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-38809",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-38809"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809"
        },
        {
          "category": "external",
          "summary": "http://github.com/spring-projects/spring-framework",
          "url": "http://github.com/spring-projects/spring-framework"
        },
        {
          "category": "external",
          "summary": "https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3",
          "url": "https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3"
        },
        {
          "category": "external",
          "summary": "https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533",
          "url": "https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533"
        },
        {
          "category": "external",
          "summary": "https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85",
          "url": "https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85"
        },
        {
          "category": "external",
          "summary": "https://github.com/spring-projects/spring-framework/issues/33372",
          "url": "https://github.com/spring-projects/spring-framework/issues/33372"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2024-38809",
          "url": "https://spring.io/security/cve-2024-38809"
        }
      ],
      "release_date": "2024-09-24T18:34:43+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request"
    },
    {
      "cve": "CVE-2024-38816",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2024-09-13T06:20:08.422867+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2312060"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a FileSystemResource location.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Path traversal vulnerabilities in applications that serve static resources via RouterFunctions and FileSystemResource pose a important security risk, as they allow attackers to bypass access controls and retrieve arbitrary files from the server\u0027s filesystem. This type of attack can lead to unauthorized exposure of sensitive data, such as configuration files, environment variables, or authentication credentials. If exploited, it can further facilitate privilege escalation, lateral movement, or remote code execution within the system. Given the broad access it grants to the server\u0027s filesystem, the potential for system compromise makes path traversal vulnerabilities a high-severity issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-38816"
        },
        {
          "category": "external",
          "summary": "RHBZ#2312060",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312060"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-38816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-38816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-38816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38816"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2024-38816",
          "url": "https://spring.io/security/cve-2024-38816"
        }
      ],
      "release_date": "2024-09-13T06:15:11.190000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource"
    },
    {
      "cve": "CVE-2024-45294",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2024-09-06T16:20:11.403869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310447"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations (XSLT) transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This issue impacts use cases where org.hl7.fhir.core is being used within a host where external clients can submit XML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is of significant severity because it allows for XML External Entity (XXE) injection, which can lead to unauthorized access and leakage of sensitive data from the host system. In environments where external clients are permitted to submit XML files, an attacker could craft a malicious XML containing a DTD (Document Type Definition) that references external entities. When processed, this could result in the unauthorized disclosure of files, environmental variables, or other confidential data from the server, potentially compromising the integrity and confidentiality of the system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310447",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf"
        }
      ],
      "release_date": "2024-09-06T16:15:03.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-14T15:53:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8064"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4.4.3 for Spring Boot"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Streams for Apache Kafka 2.8.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat AMQ Streams 2.8.0 serves as a replacement for Red Hat\nAMQ Streams 2.7.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n* Zookeeper, Kafka, Cruise Control: org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] \n\"(CVE-2024-8184)\"\n\n* Zookeeper, Kafka : org.eclipse.jetty/jetty-servlets: Jetty DOS vulnerability on DosFilter [amq-st-2] \"(CVE-2024-9823)\"\n\n* Zookeeper, Kafka, Drain Cleaner, Cruise Control: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader \"(CVE-2024-47554)\"\n\n* Kafka: (com.google.protobuf:protobuf-java@3.23.4). Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users \"(CVE-2024-7254)\"\n\n\"Drain Cleaner: Awaiting Analysis(CVE-2024-29025)\"\n\n* Kroxylicoius: When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server\u0027s hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. \"(CVE-2024-8285)\"",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:9571",
        "url": "https://access.redhat.com/errata/RHSA-2024:9571"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2272907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907"
      },
      {
        "category": "external",
        "summary": "2308606",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308606"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "external",
        "summary": "2316271",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
      },
      {
        "category": "external",
        "summary": "2318564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
      },
      {
        "category": "external",
        "summary": "2318565",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318565"
      },
      {
        "category": "external",
        "summary": "ASUI-91",
        "url": "https://issues.redhat.com/browse/ASUI-91"
      },
      {
        "category": "external",
        "summary": "ENTMQST-2632",
        "url": "https://issues.redhat.com/browse/ENTMQST-2632"
      },
      {
        "category": "external",
        "summary": "ENTMQST-3288",
        "url": "https://issues.redhat.com/browse/ENTMQST-3288"
      },
      {
        "category": "external",
        "summary": "ENTMQST-4019",
        "url": "https://issues.redhat.com/browse/ENTMQST-4019"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5199",
        "url": "https://issues.redhat.com/browse/ENTMQST-5199"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5669",
        "url": "https://issues.redhat.com/browse/ENTMQST-5669"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5674",
        "url": "https://issues.redhat.com/browse/ENTMQST-5674"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5740",
        "url": "https://issues.redhat.com/browse/ENTMQST-5740"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5789",
        "url": "https://issues.redhat.com/browse/ENTMQST-5789"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5843",
        "url": "https://issues.redhat.com/browse/ENTMQST-5843"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5850",
        "url": "https://issues.redhat.com/browse/ENTMQST-5850"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5863",
        "url": "https://issues.redhat.com/browse/ENTMQST-5863"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5865",
        "url": "https://issues.redhat.com/browse/ENTMQST-5865"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5915",
        "url": "https://issues.redhat.com/browse/ENTMQST-5915"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6028",
        "url": "https://issues.redhat.com/browse/ENTMQST-6028"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6032",
        "url": "https://issues.redhat.com/browse/ENTMQST-6032"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6129",
        "url": "https://issues.redhat.com/browse/ENTMQST-6129"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6183",
        "url": "https://issues.redhat.com/browse/ENTMQST-6183"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6205",
        "url": "https://issues.redhat.com/browse/ENTMQST-6205"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6225",
        "url": "https://issues.redhat.com/browse/ENTMQST-6225"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6341",
        "url": "https://issues.redhat.com/browse/ENTMQST-6341"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6421",
        "url": "https://issues.redhat.com/browse/ENTMQST-6421"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6422",
        "url": "https://issues.redhat.com/browse/ENTMQST-6422"
      },
      {
        "category": "external",
        "summary": "ENTMQSTPR-43",
        "url": "https://issues.redhat.com/browse/ENTMQSTPR-43"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9571.json"
      }
    ],
    "title": "Red Hat Security Advisory: Streams for Apache Kafka 2.8.0 release and security update",
    "tracking": {
      "current_release_date": "2026-07-30T01:56:33+00:00",
      "generator": {
        "date": "2026-07-30T01:56:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2024:9571",
      "initial_release_date": "2024-11-13T16:21:03+00:00",
      "revision_history": [
        {
          "date": "2024-11-13T16:21:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-13T16:21:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T01:56:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Streams for Apache Kafka 2.8.0",
                "product": {
                  "name": "Streams for Apache Kafka 2.8.0",
                  "product_id": "Streams for Apache Kafka 2.8.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Streams for Apache Kafka"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-8184",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-14T16:01:01.239238+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty\u0027s ThreadLimitHandler.getRemote(). This flaw allows unauthorized users to cause remote denial of service (DoS) attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server\u0027s memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as moderate rather than important because it requires specific conditions to be met, including continuous, crafted requests that deliberately target memory allocation to exhaust resources. While it can cause a denial of service, it does not lead to direct compromise of sensitive data, unauthorized access, or code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/pull/11723",
          "url": "https://github.com/jetty/jetty.project/pull/11723"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30"
        }
      ],
      "release_date": "2024-10-14T15:09:37.861000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks"
    },
    {
      "cve": "CVE-2024-8285",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2024-08-29T22:39:10.882000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2308606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server\u0027s hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kroxylicious: Missing upstream Kafka TLS hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat have considered this vulnerability as a \u0027Moderate\u0027 severity given the complexity and the permission level required to perform a successful attacker.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8285"
        },
        {
          "category": "external",
          "summary": "RHBZ#2308606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8285",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8285"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8285",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8285"
        }
      ],
      "release_date": "2024-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kroxylicious: Missing upstream Kafka TLS hostname verification"
    },
    {
      "cve": "CVE-2024-9823",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-14T16:01:06.545771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty. The DosFilter can be exploited remotely by unauthorized users to trigger an out-of-memory condition by repeatedly sending specially crafted requests. This issue may cause a crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-servlets: jetty: Jetty DOS vulnerability on DosFilter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/issues/1256",
          "url": "https://github.com/jetty/jetty.project/issues/1256"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/39",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/39"
        }
      ],
      "release_date": "2024-10-14T15:03:02.293000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.eclipse.jetty:jetty-servlets: jetty: Jetty DOS vulnerability on DosFilter"
    },
    {
      "cve": "CVE-2024-29025",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-04-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2272907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, allowing data to accumulate without limits. This flaw allows an attacker to cause a denial of service by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http: Allocation of Resources Without Limits or Throttling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The vulnerability in io.netty:netty-codec-http, allowing for Allocation of Resources Without Limits or Throttling issues, is assessed as moderate severity due to its potential impact on system availability and performance. By exploiting the flaw in HttpPostRequestDecoder, an attacker can craft chunked POST requests with numerous small fields, causing excessive accumulation of data in memory buffers. This unrestricted accumulation can lead to significant memory consumption on the server, potentially exhausting available resources and resulting in denial of service (DoS) conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "RHBZ#2272907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-29025",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3",
          "url": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c",
          "url": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812",
          "url": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812"
        }
      ],
      "release_date": "2024-03-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http: Allocation of Resources Without Limits or Throttling"
    },
    {
      "cve": "CVE-2024-47554",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-03T12:00:40.921058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316271"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316271",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47554",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1",
          "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1"
        }
      ],
      "release_date": "2024-10-03T11:32:48.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus. \nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability. For\nmore information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.2.12.SP1 contains security updates. For more information, see the release notes\npage listed in the References section.\n\nSecurity Fix(es):\n\n* com.google.protobuf/protobuf: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)\n\n* org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)\n\n* com.graphql-java.graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java (CVE-2024-40094)\n\n* org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE) (CVE-2024-47561)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7676",
        "url": "https://access.redhat.com/errata/RHSA-2024:7676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7676.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.2.12.SP1 Security Update",
    "tracking": {
      "current_release_date": "2024-12-06T13:14:07+00:00",
      "generator": {
        "date": "2024-12-06T13:14:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.2"
        }
      },
      "id": "RHSA-2024:7676",
      "initial_release_date": "2024-10-10T13:43:59+00:00",
      "revision_history": [
        {
          "date": "2024-10-10T13:43:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-10T13:43:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-06T13:14:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.2",
                "product": {
                  "name": "Red Hat build of Quarkus 3.2",
                  "product_id": "Red Hat build of Quarkus 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44549",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-10-01T01:34:34.576000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315808"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Sling Commons Messaging Mail(angus-mail), which provides a simple interface for sending emails via SMTPS in OSGi, does not offer an option to enable server identity checks, leaving connections vulnerable to \"man-in-the-middle\" attacks and can allow insecure email communication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability should be considered of important severity rather than moderate because it directly impacts the integrity and confidentiality of email communications over SMTPS. By disabling server identity checks, it leaves the communication channel vulnerable to \"man-in-the-middle\" (MITM) attacks, where an attacker could intercept, alter, or eavesdrop on email traffic by impersonating the legitimate mail server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315808",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315808"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44549"
        }
      ],
      "release_date": "2023-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication"
    },
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-40094",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-07-30T07:20:08+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in GraphQL Java, affecting versions prior to 21.5. This flaw allows an attacker to perform a denial of service (DoS) attack via introspection queries. The issue arises due to the improper handling of ExecutableNormalizedFields (ENFs), which are not adequately considered during the introspection query process. This issue could lead to resource exhaustion and service disruption under certain conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-40094",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40094"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a",
          "url": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/discussions/3641",
          "url": "https://github.com/graphql-java/graphql-java/discussions/3641"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/pull/3539",
          "url": "https://github.com/graphql-java/graphql-java/pull/3539"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5",
          "url": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5"
        }
      ],
      "release_date": "2024-07-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T13:43:59+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7676"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Critical.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* CVE-2024-47561 org.apache.avro/avro: Schema parsing may trigger Remote Code Execution (RCE)\n* CVE-2024-7254 com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7972",
        "url": "https://access.redhat.com/errata/RHSA-2024:7972"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "external",
        "summary": "2316116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7972.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1)",
    "tracking": {
      "current_release_date": "2024-12-06T13:14:19+00:00",
      "generator": {
        "date": "2024-12-06T13:14:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.2"
        }
      },
      "id": "RHSA-2024:7972",
      "initial_release_date": "2024-10-10T14:00:25+00:00",
      "revision_history": [
        {
          "date": "2024-10-10T14:00:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-10T14:00:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-06T13:14:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel for Quarkus",
                "product": {
                  "name": "Red Hat build of Apache Camel for Quarkus",
                  "product_id": "Red Hat build of Apache Camel for Quarkus",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T14:00:25+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7972"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2024-10-02T14:04:06.018000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special \"java-class\" attribute.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users.\n\nRed Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
        }
      ],
      "release_date": "2024-10-03T12:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-10T14:00:25+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7972"
        },
        {
          "category": "workaround",
          "details": "1. Avoid parsing user-provided schemas.\n2. Ensure proper input validation and sanitization of schemas before parsing.\n3. Monitor systems for any unusual activities that may indicate exploitation attempts.\n4. Apply the principle of least privilege to minimize the potential impact of successful exploits.",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Streams for Apache Kafka 2.8.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat AMQ Streams 2.8.0 serves as a replacement for Red Hat\nAMQ Streams 2.7.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n* Zookeeper, Kafka, Cruise Control: org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] \n\"(CVE-2024-8184)\"\n\n* Zookeeper, Kafka : org.eclipse.jetty/jetty-servlets: Jetty DOS vulnerability on DosFilter [amq-st-2] \"(CVE-2024-9823)\"\n\n* Zookeeper, Kafka, Drain Cleaner, Cruise Control: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader \"(CVE-2024-47554)\"\n\n* Kafka: (com.google.protobuf:protobuf-java@3.23.4). Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users \"(CVE-2024-7254)\"\n\n\"Drain Cleaner: Awaiting Analysis(CVE-2024-29025)\"\n\n* Kroxylicoius: When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server\u0027s hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. \"(CVE-2024-8285)\"",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:9571",
        "url": "https://access.redhat.com/errata/RHSA-2024:9571"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2272907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907"
      },
      {
        "category": "external",
        "summary": "2308606",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308606"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "external",
        "summary": "2316271",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
      },
      {
        "category": "external",
        "summary": "2318564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
      },
      {
        "category": "external",
        "summary": "2318565",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318565"
      },
      {
        "category": "external",
        "summary": "ASUI-91",
        "url": "https://issues.redhat.com/browse/ASUI-91"
      },
      {
        "category": "external",
        "summary": "ENTMQST-2632",
        "url": "https://issues.redhat.com/browse/ENTMQST-2632"
      },
      {
        "category": "external",
        "summary": "ENTMQST-3288",
        "url": "https://issues.redhat.com/browse/ENTMQST-3288"
      },
      {
        "category": "external",
        "summary": "ENTMQST-4019",
        "url": "https://issues.redhat.com/browse/ENTMQST-4019"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5199",
        "url": "https://issues.redhat.com/browse/ENTMQST-5199"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5669",
        "url": "https://issues.redhat.com/browse/ENTMQST-5669"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5674",
        "url": "https://issues.redhat.com/browse/ENTMQST-5674"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5740",
        "url": "https://issues.redhat.com/browse/ENTMQST-5740"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5789",
        "url": "https://issues.redhat.com/browse/ENTMQST-5789"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5843",
        "url": "https://issues.redhat.com/browse/ENTMQST-5843"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5850",
        "url": "https://issues.redhat.com/browse/ENTMQST-5850"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5863",
        "url": "https://issues.redhat.com/browse/ENTMQST-5863"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5865",
        "url": "https://issues.redhat.com/browse/ENTMQST-5865"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5915",
        "url": "https://issues.redhat.com/browse/ENTMQST-5915"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6028",
        "url": "https://issues.redhat.com/browse/ENTMQST-6028"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6032",
        "url": "https://issues.redhat.com/browse/ENTMQST-6032"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6129",
        "url": "https://issues.redhat.com/browse/ENTMQST-6129"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6183",
        "url": "https://issues.redhat.com/browse/ENTMQST-6183"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6205",
        "url": "https://issues.redhat.com/browse/ENTMQST-6205"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6225",
        "url": "https://issues.redhat.com/browse/ENTMQST-6225"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6341",
        "url": "https://issues.redhat.com/browse/ENTMQST-6341"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6421",
        "url": "https://issues.redhat.com/browse/ENTMQST-6421"
      },
      {
        "category": "external",
        "summary": "ENTMQST-6422",
        "url": "https://issues.redhat.com/browse/ENTMQST-6422"
      },
      {
        "category": "external",
        "summary": "ENTMQSTPR-43",
        "url": "https://issues.redhat.com/browse/ENTMQSTPR-43"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9571.json"
      }
    ],
    "title": "Red Hat Security Advisory: Streams for Apache Kafka 2.8.0 release and security update",
    "tracking": {
      "current_release_date": "2024-12-17T08:38:18+00:00",
      "generator": {
        "date": "2024-12-17T08:38:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2024:9571",
      "initial_release_date": "2024-11-13T16:21:03+00:00",
      "revision_history": [
        {
          "date": "2024-11-13T16:21:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-13T16:21:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T08:38:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Streams for Apache Kafka 2.8.0",
                "product": {
                  "name": "Streams for Apache Kafka 2.8.0",
                  "product_id": "Streams for Apache Kafka 2.8.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Streams for Apache Kafka"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    },
    {
      "cve": "CVE-2024-8184",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-14T16:01:01.239238+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty\u0027s ThreadLimitHandler.getRemote(). This flaw allows unauthorized users to cause remote denial of service (DoS) attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server\u0027s memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as moderate rather than important because it requires specific conditions to be met, including continuous, crafted requests that deliberately target memory allocation to exhaust resources. While it can cause a denial of service, it does not lead to direct compromise of sensitive data, unauthorized access, or code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/pull/11723",
          "url": "https://github.com/jetty/jetty.project/pull/11723"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30"
        }
      ],
      "release_date": "2024-10-14T15:09:37.861000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks"
    },
    {
      "cve": "CVE-2024-8285",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2024-08-29T22:39:10.882000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2308606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server\u0027s hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kroxylicious: Missing upstream Kafka TLS hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat have considered this vulnerability as a \u0027Moderate\u0027 severity given the complexity and the permission level required to perform a successful attacker.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8285"
        },
        {
          "category": "external",
          "summary": "RHBZ#2308606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8285",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8285"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8285",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8285"
        }
      ],
      "release_date": "2024-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kroxylicious: Missing upstream Kafka TLS hostname verification"
    },
    {
      "cve": "CVE-2024-9823",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-14T16:01:06.545771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty. The DosFilter can be exploited remotely by unauthorized users to trigger an out-of-memory condition by repeatedly sending specially crafted requests. This issue may cause a crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-servlets: jetty: Jetty DOS vulnerability on DosFilter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9823"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/issues/1256",
          "url": "https://github.com/jetty/jetty.project/issues/1256"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/39",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/39"
        }
      ],
      "release_date": "2024-10-14T15:03:02.293000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.eclipse.jetty:jetty-servlets: jetty: Jetty DOS vulnerability on DosFilter"
    },
    {
      "cve": "CVE-2024-29025",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-04-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2272907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, allowing data to accumulate without limits. This flaw allows an attacker to cause a denial of service by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http: Allocation of Resources Without Limits or Throttling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The vulnerability in io.netty:netty-codec-http, allowing for Allocation of Resources Without Limits or Throttling issues, is assessed as moderate severity due to its potential impact on system availability and performance. By exploiting the flaw in HttpPostRequestDecoder, an attacker can craft chunked POST requests with numerous small fields, causing excessive accumulation of data in memory buffers. This unrestricted accumulation can lead to significant memory consumption on the server, potentially exhausting available resources and resulting in denial of service (DoS) conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "RHBZ#2272907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-29025",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3",
          "url": "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c",
          "url": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812",
          "url": "https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812"
        }
      ],
      "release_date": "2024-03-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http: Allocation of Resources Without Limits or Throttling"
    },
    {
      "cve": "CVE-2024-47554",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-03T12:00:40.921058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316271"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316271",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47554",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1",
          "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1"
        }
      ],
      "release_date": "2024-10-03T11:32:48.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T16:21:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.8.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.\n\nSecurity Fix(es):\n\n* com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)\n\nA Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:20052",
        "url": "https://access.redhat.com/errata/RHSA-2025:20052"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20052.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 security update",
    "tracking": {
      "current_release_date": "2026-06-30T03:31:39+00:00",
      "generator": {
        "date": "2026-06-30T03:31:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2025:20052",
      "initial_release_date": "2025-11-10T20:35:44+00:00",
      "revision_history": [
        {
          "date": "2025-11-10T20:35:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-11-10T20:35:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T03:31:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-7.4-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 8",
                "product": {
                  "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 8",
                  "product_id": "8Base-JBEAP-7.4-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 9",
                "product": {
                  "name": "Red Hat JBoss EAP 7.4 ELS for RHEL 9",
                  "product_id": "9Base-JBEAP-7.4-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el7eap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el7eap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el8eap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el8eap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el9eap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el9eap?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.23-5.GA_redhat_00004.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.23-5.GA_redhat_00004.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                "product": {
                  "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_id": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.23-5.GA_redhat_00004.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                "product": {
                  "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_id": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.23-5.GA_redhat_00004.1.el7eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk17@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                "product": {
                  "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_id": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.23-5.GA_redhat_00004.1.el8eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
                "product": {
                  "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
                  "product_id": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-protostream@4.3.7-1.Final_redhat_00001.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk17@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                "product": {
                  "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_id": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.23-5.GA_redhat_00004.1.el9eap?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch"
        },
        "product_reference": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch"
        },
        "product_reference": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 8",
          "product_id": "8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch"
        },
        "product_reference": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
        "relates_to_product_reference": "8Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src"
        },
        "product_reference": "eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src"
        },
        "product_reference": "eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 9",
          "product_id": "9Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        },
        "product_reference": "eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
        "relates_to_product_reference": "9Base-JBEAP-7.4-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
          "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
          "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
          "9Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-10T20:35:44+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:20052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el7eap.src",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el7eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el8eap.src",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el8eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-protostream-0:4.3.7-1.Final_redhat_00001.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.23-5.GA_redhat_00004.1.el9eap.src",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch",
            "9Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.23-5.GA_redhat_00004.1.el9eap.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.\n\nSecurity Fix(es):\n\n* com.google.protobuf/protobuf-java: StackOverflow vulnerability in Protocol Buffers (CVE-2024-7254)\n\nA Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:20057",
        "url": "https://access.redhat.com/errata/RHSA-2025:20057"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index"
      },
      {
        "category": "external",
        "summary": "2313454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20057.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 security update",
    "tracking": {
      "current_release_date": "2026-06-30T03:31:39+00:00",
      "generator": {
        "date": "2026-06-30T03:31:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2025:20057",
      "initial_release_date": "2025-11-10T20:47:44+00:00",
      "revision_history": [
        {
          "date": "2025-11-10T20:47:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-11-10T20:47:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T03:31:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 7",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7254",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-19T01:20:29.981665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2313454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf: StackOverflow vulnerability in Protocol Buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack\u0027s capacity, causing the application to crash or become unresponsive.\n\nThe protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "RHBZ#2313454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
          "url": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa"
        }
      ],
      "release_date": "2024-09-19T01:15:10.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-10T20:47:44+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:20057"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobuf: StackOverflow vulnerability in Protocol Buffers"
    }
  ]
}