RHSA-2023:2135: Important: Red Hat Process Automation Manager 7.13.3 security update
Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.<br>This asynchronous security patch is an update to Red Hat Process Automation Manager 7.<br>Security Fixes:<br><li> CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)</li> <li> keycloak: path traversal via double URL encoding (CVE-2022-3782)</li> <li> undertow: Infinite loop in SslConduit during close (CVE-2023-1108)</li> <li> commons-text: apache-commons-text: variable interpolation RCE (CVE-2022-42889)</li> <li> jackson-databind: deep wrapper array nesting wrt UNWRAPSINGLEVALUEARRAYS (CVE-2022-42003)</li> <li> jackson-databind: use of deeply nested arrays (CVE-2022-42004)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2135?
The severity of RHSA-2023:2135 is classified as critical.
How do I fix RHSA-2023:2135?
You can fix RHSA-2023:2135 by updating the affected version of Red Hat Process Automation Manager to the patched release provided by Red Hat.
What versions of Red Hat Process Automation Manager are affected by RHSA-2023:2135?
All supported versions of Red Hat Process Automation Manager prior to the fix in RHSA-2023:2135 are affected.
Is there a workaround for RHSA-2023:2135?
There is no known workaround for RHSA-2023:2135; applying the update is recommended.
Where can I find more information about RHSA-2023:2135?
More information about RHSA-2023:2135 can be found in the Red Hat advisory for this specific vulnerability.