[RHSA-2022:8902-01] Moderate: Red Hat Camel for Spring Boot 3.18.3 release and security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Camel for Spring Boot 3.18.3 release and security update
Advisory ID:       RHSA-2022:8902-01
Product:           Red Hat Integration
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8902
Issue date:        2022-12-08
CVE Names:         CVE-2022-25897 CVE-2022-31684 CVE-2022-42889 
=====================================================================

1. Summary:

A minor version update (from 3.14.5 to 3.18.3) is now available for Camel
for Spring Boot. The purpose of this text-only errata is to inform you
about the security issues fixed in this release.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

This release of Camel for Spring Boot 3.18.3 serves as a replacement for
Camel for Spring Boot 3.14.2 and includes bug fixes and enhancements, which
are documented in the Release Notes document linked in the References.

Security Fix(es):

* commons-text: apache-commons-text: variable interpolation
(CVE-2022-42889)

* org.eclipse.milo-sdk-server: sdk-server: Denial of Service
(CVE-2022-25897)

* reactor-netty-http: Log request headers in some cases of invalid HTTP
requests (CVE-2022-31684)

For more details about the security issues, including the impact, CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Installation instructions are available from the Camel for Spring Boot
3.18.3 product documentation page.

https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q4/html/getting_started_with_camel_spring_boot/index

https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q4/html/camel_spring_boot_reference/index

4. Bugs fixed (https://bugzilla.redhat.com/):

2135435 - CVE-2022-42889 apache-commons-text: variable interpolation RCE
2136188 - CVE-2022-25897 sdk-server: Denial of Service
2141353 - CVE-2022-31684 reactor-netty-http: Log request headers in some cases of invalid HTTP requests

5. References:

https://access.redhat.com/security/cve/CVE-2022-25897
https://access.redhat.com/security/cve/CVE-2022-31684
https://access.redhat.com/security/cve/CVE-2022-42889
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2022-Q4

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY5ISGtzjgjWX9erEAQgUiw//Vbl2hAiOE9ePsLSMh2w9RJ0guS6iSayB
jpOaib0SMTQCJ6jeohGoNuMSSTrWZuYHlaI4B37U1t1EJajgYYquouqjB+plFElD
Kj4VvoisjqIg98uUZJi6Z1cRw25w7rfFkKhiTt9niQ+35WmrYiDXWLYZlhu6cjGW
+oF4yRn36OVKysUYyDyAywgD9K+Ioovk51OmFRcNa+7iQTZwf2q1Pa4OPtkcm2D4
qY4d1JJdHiXDVon3Pq0kkyNiJJBqScavZCmGjv+je78kvElkmi1t0IcXPM/iI2gQ
reTbrocj9ObjvcnfV40pm48fgFJ30XNl6f5auwz8wbNCgQFQlN0w6GCQElsW4Ng6
P0lPjdGO11GIdgfZHYAJngmrg6L1uhhAVmfGYFo4V1v4zkUoMVjrv0R/WHVutvVa
8zSF4Meky3J9hwgwV85O7MZEcKw4sBrnA4jkxUHDcyX/X5RHv9Qv/7ljrumn5srh
T+XhDhBTf+jJVfwqjcMTKineiROsfgp1xGggDBABHl/XU/ywN3WcDHarXcrhcmTp
LZX1xIajFJAaxRNE8KmLSRizSspCWHjGfEa0TuieIkfjg038p1LiofIgCLwbh2kZ
NkWX7t1PmCpU/Z2Q5/JYqJMzfLUvLnuktbxK2wA3y5ycq14qB5BpVsoK+lX2mnHy
QEI4OplCv/A=
=diKm
-----END PGP SIGNATURE-----