Red Hat Integration Camel K vulnerabilities

20 CVEs affecting Red Hat Integration Camel K, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-7885, published 2024-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2024-7885, published 2024-08-21. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method…
CVE-2021-3690, published 2022-08-23. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from…
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2022-0084, published 2022-08-26. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed…
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2022-4244, published 2023-09-25. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with…
CVE-2021-20218, published 2021-03-16. High severity, CVSS 7.4. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to…
CVE-2022-1259, published 2022-08-31. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an…

Latest

CVE-2022-4245, published 2023-09-25. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command…
CVE-2022-41862, published 2023-03-03. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to…
CVE-2022-4492, published 2023-02-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and…
CVE-2022-1278, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2022-2764, published 2022-09-01. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.