{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency.\n\nSecurity Fix(es):\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n \n* scala: deserialization gadget chain (CVE-2022-36944)\n\n* DoS of the Okio client when handling a crafted GZIP archive (CVE-2023-3635)\n \n* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* netty: world readable temporary file containing sensitive data (CVE-2022-24823)\n\n* guava: insecure temporary directory creation (CVE-2023-2976)\n\n* Jetty servlets with multipart support may cause OOM error with client requests (CVE-2023-26048)\n\n* Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies (CVE-2023-26049)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* snappy-java: Integer overflow in shuffle leads to DoS (CVE-2023-34453)\n\n* snappy-java: Integer overflow in compress leads to DoS (CVE-2023-34454)\n\n* snappy-java: Unchecked chunk length leads to DoS (CVE-2023-34455)\n\n* Flaw in Netty's SniHandler while navigating TLS handshake; DoS (CVE-2023-34462)\n\n* RESTEasy: creation of insecure temp files (CVE-2023-0482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:5165",
            url: "https://access.redhat.com/errata/RHSA-2023:5165",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.streams&version=2.5.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.streams&version=2.5.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5",
            url: "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5",
         },
         {
            category: "external",
            summary: "2004133",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004133",
         },
         {
            category: "external",
            summary: "2004135",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004135",
         },
         {
            category: "external",
            summary: "2087186",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2087186",
         },
         {
            category: "external",
            summary: "2129809",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2129809",
         },
         {
            category: "external",
            summary: "2150009",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2150009",
         },
         {
            category: "external",
            summary: "2166004",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2166004",
         },
         {
            category: "external",
            summary: "2215229",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215229",
         },
         {
            category: "external",
            summary: "2215393",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215393",
         },
         {
            category: "external",
            summary: "2215394",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215394",
         },
         {
            category: "external",
            summary: "2215445",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215445",
         },
         {
            category: "external",
            summary: "2215465",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215465",
         },
         {
            category: "external",
            summary: "2216888",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216888",
         },
         {
            category: "external",
            summary: "2229295",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2229295",
         },
         {
            category: "external",
            summary: "2236340",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2236340",
         },
         {
            category: "external",
            summary: "2236341",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2236341",
         },
         {
            category: "external",
            summary: "ENTMQST-5081",
            url: "https://issues.redhat.com/browse/ENTMQST-5081",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5165.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update",
      tracking: {
         current_release_date: "2024-12-17T23:02:10+00:00",
         generator: {
            date: "2024-12-17T23:02:10+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2023:5165",
         initial_release_date: "2023-09-14T09:51:43+00:00",
         revision_history: [
            {
               date: "2023-09-14T09:51:43+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-09-14T09:51:43+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-17T23:02:10+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat AMQ Streams 2.5.0",
                        product: {
                           name: "Red Hat AMQ Streams 2.5.0",
                           product_id: "Red Hat AMQ Streams 2.5.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:amq_streams:2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Streams for Apache Kafka",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-37136",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-09-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2004133",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-37136",
            },
            {
               category: "external",
               summary: "RHBZ#2004133",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004133",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-37136",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-37136",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
               url: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
            },
         ],
         release_date: "2021-09-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data",
      },
      {
         cve: "CVE-2021-37137",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-09-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2004135",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-37137",
            },
            {
               category: "external",
               summary: "RHBZ#2004135",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004135",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-37137",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-37137",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
               url: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
            },
         ],
         release_date: "2021-09-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way",
      },
      {
         cve: "CVE-2022-1471",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2150009",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "SnakeYaml: Constructor Deserialization Remote Code Execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml's SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker's control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml's Constructor class nor pass untrusted data to this class. When this class is used, it’s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-1471",
            },
            {
               category: "external",
               summary: "RHBZ#2150009",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2150009",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-1471",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-1471",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
            },
            {
               category: "external",
               summary: "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
               url: "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
            },
         ],
         release_date: "2022-10-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "SnakeYaml: Constructor Deserialization Remote Code Execution",
      },
      {
         cve: "CVE-2022-24823",
         cwe: {
            id: "CWE-379",
            name: "Creation of Temporary File in Directory with Insecure Permissions",
         },
         discovery_date: "2022-05-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2087186",
            },
         ],
         notes: [
            {
               category: "description",
               text: "CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: world readable temporary file containing sensitive data",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.\n\nRed Hat Satellite 6 is not affected as is using netty 3.6.7 version which is not impacted by this vulnerability.\n\nRed Hat Fuse 7 is now in Maintenance Support Phase and should be fixed soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-24823",
            },
            {
               category: "external",
               summary: "RHBZ#2087186",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2087186",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-24823",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-24823",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-24823",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-24823",
            },
         ],
         release_date: "2022-05-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
            {
               category: "workaround",
               details: "As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty: world readable temporary file containing sensitive data",
      },
      {
         cve: "CVE-2022-36944",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-09-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2129809",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Scala's LazyList that permits code execution during deserialization. This issue could allow an attacker to craft a LazyList containing a malicious Function0 call to execute arbitrary code on a server that deserializes untrusted data.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "scala: deserialization gadget chain",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-36944",
            },
            {
               category: "external",
               summary: "RHBZ#2129809",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2129809",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-36944",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-36944",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-36944",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36944",
            },
            {
               category: "external",
               summary: "https://github.com/scala/scala/pull/10118",
               url: "https://github.com/scala/scala/pull/10118",
            },
         ],
         release_date: "2022-09-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
            {
               category: "workaround",
               details: "Users of Scala's LazyList should never permit deserialization of untrusted data.",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "scala: deserialization gadget chain",
      },
      {
         cve: "CVE-2023-0482",
         cwe: {
            id: "CWE-378",
            name: "Creation of Temporary File With Insecure Permissions",
         },
         discovery_date: "2023-01-31T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2166004",
            },
         ],
         notes: [
            {
               category: "description",
               text: "In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: creation of insecure temp files",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-0482",
            },
            {
               category: "external",
               summary: "RHBZ#2166004",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2166004",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-0482",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-0482",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0482",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0482",
            },
         ],
         release_date: "2023-01-31T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "RESTEasy: creation of insecure temp files",
      },
      {
         cve: "CVE-2023-2976",
         cwe: {
            id: "CWE-552",
            name: "Files or Directories Accessible to External Parties",
         },
         discovery_date: "2023-06-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2215229",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "guava: insecure temporary directory creation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Single Sign-On 7 ships the affected component as a layered product of Red Hat JBoss Enterprise Application 7, and as such is affected by this flaw. However, Single Sign-On 7 does not use the affected code and is not vulnerable to exploit.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-2976",
            },
            {
               category: "external",
               summary: "RHBZ#2215229",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215229",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-2976",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-2976",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-2976",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-2976",
            },
         ],
         release_date: "2023-06-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
            {
               category: "workaround",
               details: "Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "guava: insecure temporary directory creation",
      },
      {
         cve: "CVE-2023-3635",
         cwe: {
            id: "CWE-248",
            name: "Uncaught Exception",
         },
         discovery_date: "2023-07-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2229295",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "okio: GzipSource class improper exception handling",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss Enterprise Application Platform XP does contain Okio package but is not using GzipSource.java, which is the affected class.\nRed Hat support for Spring Boot is considered low impact as it's used by Dekorate during compilation process and not included in the resulting Jar.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-3635",
            },
            {
               category: "external",
               summary: "RHBZ#2229295",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2229295",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-3635",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-3635",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-3635",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-3635",
            },
         ],
         release_date: "2023-07-12T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "okio: GzipSource class improper exception handling",
      },
      {
         cve: "CVE-2023-26048",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2023-08-30T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2236340",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable state.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-26048",
            },
            {
               category: "external",
               summary: "RHBZ#2236340",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2236340",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-26048",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-26048",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-26048",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-26048",
            },
            {
               category: "external",
               summary: "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8",
               url: "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8",
            },
         ],
         release_date: "2023-04-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()",
      },
      {
         cve: "CVE-2023-26049",
         cwe: {
            id: "CWE-1286",
            name: "Improper Validation of Syntactic Correctness of Input",
         },
         discovery_date: "2023-08-30T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2236341",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the jetty-server package. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-26049",
            },
            {
               category: "external",
               summary: "RHBZ#2236341",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2236341",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-26049",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-26049",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-26049",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-26049",
            },
            {
               category: "external",
               summary: "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c",
               url: "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c",
            },
         ],
         release_date: "2023-04-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies",
      },
      {
         cve: "CVE-2023-33201",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2023-06-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2215465",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "bouncycastle: potential  blind LDAP injection attack using a self-signed certificate",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-33201",
            },
            {
               category: "external",
               summary: "RHBZ#2215465",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215465",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-33201",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-33201",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-33201",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-33201",
            },
            {
               category: "external",
               summary: "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201",
               url: "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201",
            },
         ],
         release_date: "2023-06-16T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "bouncycastle: potential  blind LDAP injection attack using a self-signed certificate",
      },
      {
         cve: "CVE-2023-34453",
         cwe: {
            id: "CWE-190",
            name: "Integer Overflow or Wraparound",
         },
         discovery_date: "2023-06-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2215393",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "snappy-java: Integer overflow in shuffle leads to DoS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-34453",
            },
            {
               category: "external",
               summary: "RHBZ#2215393",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215393",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-34453",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-34453",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-34453",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-34453",
            },
         ],
         release_date: "2023-06-15T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "snappy-java: Integer overflow in shuffle leads to DoS",
      },
      {
         cve: "CVE-2023-34454",
         cwe: {
            id: "CWE-190",
            name: "Integer Overflow or Wraparound",
         },
         discovery_date: "2023-06-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2215394",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "snappy-java: Integer overflow in compress leads to DoS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-34454",
            },
            {
               category: "external",
               summary: "RHBZ#2215394",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215394",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-34454",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-34454",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-34454",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-34454",
            },
         ],
         release_date: "2023-06-15T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "snappy-java: Integer overflow in compress leads to DoS",
      },
      {
         cve: "CVE-2023-34455",
         cwe: {
            id: "CWE-1285",
            name: "Improper Validation of Specified Index, Position, or Offset in Input",
         },
         discovery_date: "2023-06-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2215445",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Snappy-java's fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "snappy-java: Unchecked chunk length leads to DoS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-34455",
            },
            {
               category: "external",
               summary: "RHBZ#2215445",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2215445",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-34455",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-34455",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-34455",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-34455",
            },
         ],
         release_date: "2023-06-16T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "snappy-java: Unchecked chunk length leads to DoS",
      },
      {
         cve: "CVE-2023-34462",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2023-06-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2216888",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: SniHandler 16MB allocation leads to OOM",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.5.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-34462",
            },
            {
               category: "external",
               summary: "RHBZ#2216888",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216888",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-34462",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-34462",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-34462",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-34462",
            },
         ],
         release_date: "2023-06-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-14T09:51:43+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5165",
            },
            {
               category: "workaround",
               details: "Configuration of SniHandler with an idle timeout will mitigate this issue.",
               product_ids: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.5.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty: SniHandler 16MB allocation leads to OOM",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat AMQ Streams 2.4.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. \n\nThis release of Red Hat AMQ Streams 2.4.0 serves as a replacement for Red Hat AMQ Streams 2.3.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n\n* scala: deserialization gadget chain (CVE-2022-36944)\n\n* json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) (CVE-2023-1370)\n\n* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)\n\n* okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341)\n\n* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)\n\n* netty: world readable temporary file containing sensitive data (CVE-2022-24823)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* Red Hat A-MQ Streams: component version with information disclosure flaw (CVE-2023-0833)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:3223",
            url: "https://access.redhat.com/errata/RHSA-2023:3223",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.streams&version=2.4.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.streams&version=2.4.0",
         },
         {
            category: "external",
            summary: "2004133",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004133",
         },
         {
            category: "external",
            summary: "2004135",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004135",
         },
         {
            category: "external",
            summary: "2064698",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
         },
         {
            category: "external",
            summary: "2087186",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2087186",
         },
         {
            category: "external",
            summary: "2129809",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2129809",
         },
         {
            category: "external",
            summary: "2135244",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
         },
         {
            category: "external",
            summary: "2135247",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
         },
         {
            category: "external",
            summary: "2135770",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135770",
         },
         {
            category: "external",
            summary: "2135771",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135771",
         },
         {
            category: "external",
            summary: "2154086",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2154086",
         },
         {
            category: "external",
            summary: "2169845",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2169845",
         },
         {
            category: "external",
            summary: "2185707",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2185707",
         },
         {
            category: "external",
            summary: "2188542",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2188542",
         },
         {
            category: "external",
            summary: "ENTMQST-4107",
            url: "https://issues.redhat.com/browse/ENTMQST-4107",
         },
         {
            category: "external",
            summary: "ENTMQST-4541",
            url: "https://issues.redhat.com/browse/ENTMQST-4541",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3223.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat AMQ Streams 2.4.0 release and security update",
      tracking: {
         current_release_date: "2024-12-17T21:17:37+00:00",
         generator: {
            date: "2024-12-17T21:17:37+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2023:3223",
         initial_release_date: "2023-05-18T09:54:05+00:00",
         revision_history: [
            {
               date: "2023-05-18T09:54:05+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-05-18T09:54:05+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-17T21:17:37+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat AMQ Streams 2.4.0",
                        product: {
                           name: "Red Hat AMQ Streams 2.4.0",
                           product_id: "Red Hat AMQ Streams 2.4.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:amq_streams:2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Streams for Apache Kafka",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-36518",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-03-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064698",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: denial of service via a large depth of nested objects",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "CodeReady Studio is no longer supported and therefore this flaw will not be addressed in CodeReady Studio.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "RHBZ#2064698",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
               url: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
            },
         ],
         release_date: "2020-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: denial of service via a large depth of nested objects",
      },
      {
         cve: "CVE-2021-0341",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2022-10-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2154086",
            },
         ],
         notes: [
            {
               category: "description",
               text: "In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "okhttp: information disclosure via improperly used cryptographic function",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-0341",
            },
            {
               category: "external",
               summary: "RHBZ#2154086",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2154086",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-0341",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-0341",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-0341",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-0341",
            },
            {
               category: "external",
               summary: "https://source.android.com/security/bulletin/2021-02-01",
               url: "https://source.android.com/security/bulletin/2021-02-01",
            },
         ],
         release_date: "2021-02-10T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "okhttp: information disclosure via improperly used cryptographic function",
      },
      {
         cve: "CVE-2021-37136",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-09-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2004133",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-37136",
            },
            {
               category: "external",
               summary: "RHBZ#2004133",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004133",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-37136",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-37136",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
               url: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
            },
         ],
         release_date: "2021-09-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data",
      },
      {
         cve: "CVE-2021-37137",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-09-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2004135",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-37137",
            },
            {
               category: "external",
               summary: "RHBZ#2004135",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2004135",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-37137",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-37137",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
               url: "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
            },
         ],
         release_date: "2021-09-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way",
      },
      {
         cve: "CVE-2021-46877",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2023-04-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2185707",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-46877",
            },
            {
               category: "external",
               summary: "RHBZ#2185707",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2185707",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-46877",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-46877",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-46877",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-46877",
            },
         ],
         release_date: "2023-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode",
      },
      {
         cve: "CVE-2022-24823",
         cwe: {
            id: "CWE-379",
            name: "Creation of Temporary File in Directory with Insecure Permissions",
         },
         discovery_date: "2022-05-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2087186",
            },
         ],
         notes: [
            {
               category: "description",
               text: "CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: world readable temporary file containing sensitive data",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.\n\nRed Hat Satellite 6 is not affected as is using netty 3.6.7 version which is not impacted by this vulnerability.\n\nRed Hat Fuse 7 is now in Maintenance Support Phase and should be fixed soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-24823",
            },
            {
               category: "external",
               summary: "RHBZ#2087186",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2087186",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-24823",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-24823",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-24823",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-24823",
            },
         ],
         release_date: "2022-05-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
            {
               category: "workaround",
               details: "As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty: world readable temporary file containing sensitive data",
      },
      {
         cve: "CVE-2022-36944",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-09-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2129809",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Scala's LazyList that permits code execution during deserialization. This issue could allow an attacker to craft a LazyList containing a malicious Function0 call to execute arbitrary code on a server that deserializes untrusted data.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "scala: deserialization gadget chain",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-36944",
            },
            {
               category: "external",
               summary: "RHBZ#2129809",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2129809",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-36944",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-36944",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-36944",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36944",
            },
            {
               category: "external",
               summary: "https://github.com/scala/scala/pull/10118",
               url: "https://github.com/scala/scala/pull/10118",
            },
         ],
         release_date: "2022-09-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
            {
               category: "workaround",
               details: "Users of Scala's LazyList should never permit deserialization of untrusted data.",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "scala: deserialization gadget chain",
      },
      {
         cve: "CVE-2022-40149",
         cwe: {
            id: "CWE-787",
            name: "Out-of-bounds Write",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135771",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: parser crash by stackoverflow",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "RHBZ#2135771",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135771",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jettison: parser crash by stackoverflow",
      },
      {
         cve: "CVE-2022-40150",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135770",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: memory exhaustion via user-supplied XML or JSON data",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "RHBZ#2135770",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135770",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "jettison: memory exhaustion via user-supplied XML or JSON data",
      },
      {
         cve: "CVE-2022-42003",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135244",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42003",
            },
            {
               category: "external",
               summary: "RHBZ#2135244",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
      },
      {
         cve: "CVE-2022-42004",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135247",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: use of deeply nested arrays",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42004",
            },
            {
               category: "external",
               summary: "RHBZ#2135247",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: use of deeply nested arrays",
      },
      {
         cve: "CVE-2023-0833",
         cwe: {
            id: "CWE-209",
            name: "Generation of Error Message Containing Sensitive Information",
         },
         discovery_date: "2023-02-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2169845",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Streams: component version with information disclosure flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-0833",
            },
            {
               category: "external",
               summary: "RHBZ#2169845",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2169845",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-0833",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-0833",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0833",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0833",
            },
            {
               category: "external",
               summary: "https://github.com/square/okhttp/issues/6738",
               url: "https://github.com/square/okhttp/issues/6738",
            },
         ],
         release_date: "2023-02-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Streams: component version with information disclosure flaw",
      },
      {
         cve: "CVE-2023-1370",
         cwe: {
            id: "CWE-674",
            name: "Uncontrolled Recursion",
         },
         discovery_date: "2023-04-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2188542",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘[‘ or ‘{‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-1370",
            },
            {
               category: "external",
               summary: "RHBZ#2188542",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2188542",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-1370",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-1370",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1370",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1370",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-493p-pfq6-5258",
               url: "https://github.com/advisories/GHSA-493p-pfq6-5258",
            },
            {
               category: "external",
               summary: "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/",
               url: "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/",
            },
         ],
         release_date: "2023-03-22T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)",
      },
      {
         cve: "CVE-2023-25194",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2023-02-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2216516",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Apache Kafka Connect's REST API that permits configuration of SASL property by an authenticated operator, which could allow connection to a malicious LDAP server and subsequent deserialization of malicious content. This issue could allow an authenticated attacker to cause a denial of service or execute arbitrary code on the server, given presence of vulnerable classes on the server's classpath.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat AMQ Streams 2.4.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-25194",
            },
            {
               category: "external",
               summary: "RHBZ#2216516",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216516",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-25194",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-25194",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-25194",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-25194",
            },
            {
               category: "external",
               summary: "https://kafka.apache.org/cve-list#CVE-2023-25194",
               url: "https://kafka.apache.org/cve-list#CVE-2023-25194",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz",
               url: "https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz",
            },
         ],
         release_date: "2023-02-07T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-18T09:54:05+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:3223",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat AMQ Streams 2.4.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect",
      },
   ],
}