Red Hat Integration Service Registry vulnerabilities

7 CVEs affecting Red Hat Integration Service Registry, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44487, published 2023-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2022-1278, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2022-41862, published 2023-03-03. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to…
CVE-2022-4492, published 2023-02-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and…
CVE-2021-3536, published 2021-05-20. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This…