Red Hat Integration Camel Quarkus vulnerabilities

8 CVEs affecting Red Hat Integration Camel Quarkus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4853, published 2023-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2021-3690, published 2022-08-23. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from…
CVE-2022-0084, published 2022-08-26. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed…
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2021-3642, published 2021-08-05. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest…
CVE-2022-41862, published 2023-03-03. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to…
CVE-2021-3536, published 2021-05-20. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This…
CVE-2021-4178, published 2022-08-24. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and…