{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update is now available for Red Hat Process Automation Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nThis asynchronous security patch is an update to Red Hat Process Automation Manager 7.\n\nSecurity Fixes:\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n\n* undertow: Infinite loop in SslConduit during close (CVE-2023-1108)\n\n* commons-text: apache-commons-text: variable interpolation RCE (CVE-2022-42889)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:2135",
            url: "https://access.redhat.com/errata/RHSA-2023:2135",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2135244",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
         },
         {
            category: "external",
            summary: "2135247",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
         },
         {
            category: "external",
            summary: "2135435",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135435",
         },
         {
            category: "external",
            summary: "2138971",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2138971",
         },
         {
            category: "external",
            summary: "2155682",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155682",
         },
         {
            category: "external",
            summary: "2174246",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2174246",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2135.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.3 security update",
      tracking: {
         current_release_date: "2025-03-14T23:59:20+00:00",
         generator: {
            date: "2025-03-14T23:59:20+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.1",
            },
         },
         id: "RHSA-2023:2135",
         initial_release_date: "2023-05-04T15:59:31+00:00",
         revision_history: [
            {
               date: "2023-05-04T15:59:31+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-05-04T15:59:31+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-14T23:59:20+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "RHPAM 7.13.1 async",
                        product: {
                           name: "RHPAM 7.13.1 async",
                           product_id: "RHPAM 7.13.1 async",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Process Automation Manager",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-3782",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         discovery_date: "2022-10-31T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2138971",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: path traversal via double URL encoding",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason Quarkus is marked with Low impact.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-3782",
            },
            {
               category: "external",
               summary: "RHBZ#2138971",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2138971",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-3782",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-3782",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-3782",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-3782",
            },
         ],
         release_date: "2022-12-12T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "keycloak: path traversal via double URL encoding",
      },
      {
         cve: "CVE-2022-4244",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         discovery_date: "2022-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2149841",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "codehaus-plexus: Directory Traversal",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Single Sign-On uses this package for testing purposes and is not delivered with the distribution. Hence not affected status.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-4244",
            },
            {
               category: "external",
               summary: "RHBZ#2149841",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149841",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-4244",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-4244",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-4244",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-4244",
            },
         ],
         release_date: "2022-12-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "codehaus-plexus: Directory Traversal",
      },
      {
         cve: "CVE-2022-4245",
         cwe: {
            id: "CWE-91",
            name: "XML Injection (aka Blind XPath Injection)",
         },
         discovery_date: "2022-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2149843",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "codehaus-plexus: XML External Entity (XXE) Injection",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-4245",
            },
            {
               category: "external",
               summary: "RHBZ#2149843",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149843",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-4245",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-4245",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-4245",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-4245",
            },
         ],
         release_date: "2022-12-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "codehaus-plexus: XML External Entity (XXE) Injection",
      },
      {
         cve: "CVE-2022-40149",
         cwe: {
            id: "CWE-787",
            name: "Out-of-bounds Write",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135771",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: parser crash by stackoverflow",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "RHBZ#2135771",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135771",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jettison: parser crash by stackoverflow",
      },
      {
         cve: "CVE-2022-40150",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135770",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: memory exhaustion via user-supplied XML or JSON data",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "RHBZ#2135770",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135770",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "jettison: memory exhaustion via user-supplied XML or JSON data",
      },
      {
         cve: "CVE-2022-42003",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135244",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42003",
            },
            {
               category: "external",
               summary: "RHBZ#2135244",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
      },
      {
         cve: "CVE-2022-42004",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135247",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: use of deeply nested arrays",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42004",
            },
            {
               category: "external",
               summary: "RHBZ#2135247",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: use of deeply nested arrays",
      },
      {
         cve: "CVE-2022-42889",
         cwe: {
            id: "CWE-1188",
            name: "Initialization of a Resource with an Insecure Default",
         },
         discovery_date: "2022-10-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135435",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Apache Commons Text packages 1.5 through 1.9.  The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-text: variable interpolation RCE",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n  - Usage of specific methods that interpolate the variables as described in the flaw\n  - Usage of external input for those methods\n  - Usage of that external input has to be unsanitized/no \"allow list\"/etc.\n\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\n\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42889",
            },
            {
               category: "external",
               summary: "RHBZ#2135435",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135435",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42889",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42889",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
            },
            {
               category: "external",
               summary: "https://blogs.apache.org/security/entry/cve-2022-42889",
               url: "https://blogs.apache.org/security/entry/cve-2022-42889",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
               url: "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
            },
            {
               category: "external",
               summary: "https://seclists.org/oss-sec/2022/q4/22",
               url: "https://seclists.org/oss-sec/2022/q4/22",
            },
         ],
         release_date: "2022-10-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
            {
               category: "workaround",
               details: "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "apache-commons-text: variable interpolation RCE",
      },
      {
         cve: "CVE-2022-45693",
         cwe: {
            id: "CWE-787",
            name: "Out-of-bounds Write",
         },
         discovery_date: "2022-12-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155970",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-45693",
            },
            {
               category: "external",
               summary: "RHBZ#2155970",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155970",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-45693",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-45693",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
      },
      {
         cve: "CVE-2022-46363",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2022-12-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155681",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: directory listing / code exfiltration",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-46363",
            },
            {
               category: "external",
               summary: "RHBZ#2155681",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155681",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-46363",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-46363",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
               url: "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: directory listing / code exfiltration",
      },
      {
         cve: "CVE-2022-46364",
         cwe: {
            id: "CWE-918",
            name: "Server-Side Request Forgery (SSRF)",
         },
         discovery_date: "2022-12-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155682",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSRF Vulnerability",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-46364",
            },
            {
               category: "external",
               summary: "RHBZ#2155682",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155682",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-46364",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-46364",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-46364",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-46364",
            },
            {
               category: "external",
               summary: "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2",
               url: "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSRF Vulnerability",
      },
      {
         cve: "CVE-2023-1108",
         cwe: {
            id: "CWE-835",
            name: "Loop with Unreachable Exit Condition ('Infinite Loop')",
         },
         discovery_date: "2023-02-07T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2174246",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Undertow: Infinite loop in SslConduit during close",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-1108",
            },
            {
               category: "external",
               summary: "RHBZ#2174246",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2174246",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-1108",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-1108",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1108",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1108",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-m4mm-pg93-fv78",
               url: "https://github.com/advisories/GHSA-m4mm-pg93-fv78",
            },
         ],
         release_date: "2023-03-07T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Undertow: Infinite loop in SslConduit during close",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update is now available for Red Hat Process Automation Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nThis asynchronous security patch is an update to Red Hat Process Automation Manager 7.\n\nSecurity Fixes:\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n\n* undertow: Infinite loop in SslConduit during close (CVE-2023-1108)\n\n* commons-text: apache-commons-text: variable interpolation RCE (CVE-2022-42889)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:2135",
            url: "https://access.redhat.com/errata/RHSA-2023:2135",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2135244",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
         },
         {
            category: "external",
            summary: "2135247",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
         },
         {
            category: "external",
            summary: "2135435",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135435",
         },
         {
            category: "external",
            summary: "2138971",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2138971",
         },
         {
            category: "external",
            summary: "2155682",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155682",
         },
         {
            category: "external",
            summary: "2174246",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2174246",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2135.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.3 security update",
      tracking: {
         current_release_date: "2024-12-16T16:07:46+00:00",
         generator: {
            date: "2024-12-16T16:07:46+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2023:2135",
         initial_release_date: "2023-05-04T15:59:31+00:00",
         revision_history: [
            {
               date: "2023-05-04T15:59:31+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-05-04T15:59:31+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-16T16:07:46+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "RHPAM 7.13.1 async",
                        product: {
                           name: "RHPAM 7.13.1 async",
                           product_id: "RHPAM 7.13.1 async",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Process Automation Manager",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-3782",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         discovery_date: "2022-10-31T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2138971",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: path traversal via double URL encoding",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason Quarkus is marked with Low impact.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-3782",
            },
            {
               category: "external",
               summary: "RHBZ#2138971",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2138971",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-3782",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-3782",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-3782",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-3782",
            },
         ],
         release_date: "2022-12-12T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "keycloak: path traversal via double URL encoding",
      },
      {
         cve: "CVE-2022-4244",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         discovery_date: "2022-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2149841",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "codehaus-plexus: Directory Traversal",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Single Sign-On uses this package for testing purposes and is not delivered with the distribution. Hence not affected status.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-4244",
            },
            {
               category: "external",
               summary: "RHBZ#2149841",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149841",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-4244",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-4244",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-4244",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-4244",
            },
         ],
         release_date: "2022-12-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "codehaus-plexus: Directory Traversal",
      },
      {
         cve: "CVE-2022-4245",
         cwe: {
            id: "CWE-91",
            name: "XML Injection (aka Blind XPath Injection)",
         },
         discovery_date: "2022-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2149843",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "codehaus-plexus: XML External Entity (XXE) Injection",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-4245",
            },
            {
               category: "external",
               summary: "RHBZ#2149843",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149843",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-4245",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-4245",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-4245",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-4245",
            },
         ],
         release_date: "2022-12-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "codehaus-plexus: XML External Entity (XXE) Injection",
      },
      {
         cve: "CVE-2022-40149",
         cwe: {
            id: "CWE-787",
            name: "Out-of-bounds Write",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135771",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: parser crash by stackoverflow",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "RHBZ#2135771",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135771",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40149",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jettison: parser crash by stackoverflow",
      },
      {
         cve: "CVE-2022-40150",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135770",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: memory exhaustion via user-supplied XML or JSON data",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "RHBZ#2135770",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135770",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-40150",
            },
            {
               category: "external",
               summary: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
               url: "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1",
            },
         ],
         release_date: "2022-09-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "jettison: memory exhaustion via user-supplied XML or JSON data",
      },
      {
         cve: "CVE-2022-42003",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135244",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42003",
            },
            {
               category: "external",
               summary: "RHBZ#2135244",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135244",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42003",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
      },
      {
         cve: "CVE-2022-42004",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-10-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135247",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: use of deeply nested arrays",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42004",
            },
            {
               category: "external",
               summary: "RHBZ#2135247",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135247",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42004",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
            },
         ],
         release_date: "2022-10-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: use of deeply nested arrays",
      },
      {
         cve: "CVE-2022-42889",
         cwe: {
            id: "CWE-1188",
            name: "Initialization of a Resource with an Insecure Default",
         },
         discovery_date: "2022-10-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2135435",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Apache Commons Text packages 1.5 through 1.9.  The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-text: variable interpolation RCE",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n  - Usage of specific methods that interpolate the variables as described in the flaw\n  - Usage of external input for those methods\n  - Usage of that external input has to be unsanitized/no \"allow list\"/etc.\n\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\n\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-42889",
            },
            {
               category: "external",
               summary: "RHBZ#2135435",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2135435",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-42889",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-42889",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
            },
            {
               category: "external",
               summary: "https://blogs.apache.org/security/entry/cve-2022-42889",
               url: "https://blogs.apache.org/security/entry/cve-2022-42889",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
               url: "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
            },
            {
               category: "external",
               summary: "https://seclists.org/oss-sec/2022/q4/22",
               url: "https://seclists.org/oss-sec/2022/q4/22",
            },
         ],
         release_date: "2022-10-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
            {
               category: "workaround",
               details: "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "apache-commons-text: variable interpolation RCE",
      },
      {
         cve: "CVE-2022-45693",
         cwe: {
            id: "CWE-787",
            name: "Out-of-bounds Write",
         },
         discovery_date: "2022-12-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155970",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-45693",
            },
            {
               category: "external",
               summary: "RHBZ#2155970",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155970",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-45693",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-45693",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
      },
      {
         cve: "CVE-2022-46363",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2022-12-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155681",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: directory listing / code exfiltration",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-46363",
            },
            {
               category: "external",
               summary: "RHBZ#2155681",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155681",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-46363",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-46363",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
               url: "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: directory listing / code exfiltration",
      },
      {
         cve: "CVE-2022-46364",
         cwe: {
            id: "CWE-918",
            name: "Server-Side Request Forgery (SSRF)",
         },
         discovery_date: "2022-12-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2155682",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSRF Vulnerability",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-46364",
            },
            {
               category: "external",
               summary: "RHBZ#2155682",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2155682",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-46364",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-46364",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-46364",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-46364",
            },
            {
               category: "external",
               summary: "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2",
               url: "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2",
            },
         ],
         release_date: "2022-12-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSRF Vulnerability",
      },
      {
         cve: "CVE-2023-1108",
         cwe: {
            id: "CWE-835",
            name: "Loop with Unreachable Exit Condition ('Infinite Loop')",
         },
         discovery_date: "2023-02-07T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2174246",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Undertow: Infinite loop in SslConduit during close",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "RHPAM 7.13.1 async",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-1108",
            },
            {
               category: "external",
               summary: "RHBZ#2174246",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2174246",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-1108",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-1108",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-1108",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-1108",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-m4mm-pg93-fv78",
               url: "https://github.com/advisories/GHSA-m4mm-pg93-fv78",
            },
         ],
         release_date: "2023-03-07T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-05-04T15:59:31+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "RHPAM 7.13.1 async",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "RHPAM 7.13.1 async",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Undertow: Infinite loop in SslConduit during close",
      },
   ],
}