Home / mailings [RHSA-2022:8761-01] Moderate: Red Hat support for Spring Boot 2.7.2 update
Posted on 14 December 2022
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Moderate: Red Hat support for Spring Boot 2.7.2 update
Advisory ID: RHSA-2022:8761-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8761
Issue date: 2022-12-14
CVE Names: CVE-2020-5404 CVE-2021-4178 CVE-2021-22569
CVE-2022-1259 CVE-2022-1319 CVE-2022-22950
=====================================================================
1. Summary:
An update is now available for Red Hat OpenShift Application Runtimes.
2. Description:
Red Hat support for Spring Boot provides an application platform that
reduces the complexity of developing and operating applications (monoliths
and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.7.2 serves as a
replacement for Red Hat support for Spring Boot 2.5.12, and includes
security, bug fixes and enhancements. For more information, see the release
notes listed in the References section.
Security Fix(es):
* reactor-netty: specific redirect configuration allows for a credentials
leak (CVE-2020-5404)
* kubernetes-client: Insecure deserialization in unmarshalYaml method
(CVE-2021-4178)
* protobuf-java: potential DoS in the parsing procedure for binary data
(CVE-2021-22569)
* undertow: potential security issue in flow control over HTTP/2 may lead
to DOS(incomplete fix for CVE-2021-3629) (CVE-2022-1259)
* undertow: Double AJP response for 400 from EAP 7 results in CPING
failures (CVE-2022-1319)
* spring-expression: Denial of service via specially crafted SpEL
expression (CVE-2022-22950)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link for the
update. You must be logged in to download the update.
4. Bugs fixed (https://bugzilla.redhat.com/):
1975160 - CVE-2020-5404 reactor-netty: specific redirect configuration allows for a credentials leak
2034388 - CVE-2021-4178 kubernetes-client: Insecure deserialization in unmarshalYaml method
2039903 - CVE-2021-22569 protobuf-java: potential DoS in the parsing procedure for binary data
2069414 - CVE-2022-22950 spring-expression: Denial of service via specially crafted SpEL expression
2072339 - CVE-2022-1259 undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
2073890 - CVE-2022-1319 undertow: Double AJP response for 400 from EAP 7 results in CPING failures
5. References:
https://access.redhat.com/security/cve/CVE-2020-5404
https://access.redhat.com/security/cve/CVE-2021-4178
https://access.redhat.com/security/cve/CVE-2021-22569
https://access.redhat.com/security/cve/CVE-2022-1259
https://access.redhat.com/security/cve/CVE-2022-1319
https://access.redhat.com/security/cve/CVE-2022-22950
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.spring.boot&version=2.7.2
https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.7/html/release_notes_for_spring_boot_2.7/index
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
