RHSA-2023:7653: Important: Service Registry (container images) release and security update [2.5.4 GA]
Important: Service Registry (container images) release and security update [2.5.4 GA]
Other sources
This release of Red Hat Integration - Service Registry 2.5.4 GA includes the following security fixes.Security Fix(es): undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [rhint-serv-2] (CVE-2023-44487) quarkus-vertx-http: quarkus: HTTP security policy bypass [rhint-serv-2] (CVE-2023-4853) netty: SniHandler 16MB allocation leads to OOM [rhint-serv-2] (CVE-2023-34462) snappy-java: Unchecked chunk length leads to DoS [rhint-serv-2] (CVE-2023-34455) quarkus-oidc: ID and access tokens leak via the authorization code flow [rhint-serv-2] (CVE-2023-1584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:7653?
The severity of RHSA-2023:7653 is high.
What software is affected by RHSA-2023:7653?
Red Hat Integration - Service Registry is affected by RHSA-2023:7653.
How can I fix RHSA-2023:7653?
To fix RHSA-2023:7653, you should update to the latest version (2.5.4 GA) of Red Hat Integration - Service Registry.
Where can I find more information about RHSA-2023:7653?
You can find more information about RHSA-2023:7653 on the Red Hat Customer Portal (https://access.redhat.com/errata/RHSA-2023:7653) and on Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2180886, https://bugzilla.redhat.com/show_bug.cgi?id=2215445).