[RHSA-2023:3667-01] Moderate: Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update
Advisory ID:       RHSA-2023:3667-01
Product:           Red Hat Integration
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3667
Issue date:        2023-06-19
CVE Names:         CVE-2021-37533 CVE-2023-1436 
=====================================================================

1. Summary:

Red Hat Integration Camel Extensions for Quarkus 2.13.3 release and
security update is now available. The purpose of this text-only errata is
to inform you about the security issues fixed.

Red Hat Product Security has rated this update as having an impact of
Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

2. Description:

A security update for Camel Extensions for Quarkus 2.13.3 is now available.
The purpose of this text-only errata is to inform you about the security
issues fixed.
Red Hat Product Security has rated this update as having an impact of
Important.

A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

 Security Fix(es):

  * CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray
* CVE-2021-37533 apache-commons-net: FTP client trusts the host from
PASV response by default

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2169924 - CVE-2021-37533 apache-commons-net: FTP client trusts the host from PASV response by default
2182788 - CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray

5. References:

https://access.redhat.com/security/cve/CVE-2021-37533
https://access.redhat.com/security/cve/CVE-2023-1436
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/cve-2023-1436
https://access.redhat.com/security/cve/cve-2021-37533

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIUAwUBZJCi1dzjgjWX9erEAQhWAg/4syBLRrvw0W32wjD5+839JAqM2d3Y0GFc
zvwz0qBvx07pXZD2ZxMP4vHU56nSQp9sWRVCBZ8Cm2/zleM9bNh8REutNVHnyKgG
sruTkXheoAF2D3Qb8xAYlJi3GaJuRKoVC3EwRGHEXJBtT/Q1EyDgkOMDUMbBo7Im
ZETVo/rOZD4gurDr/gCKWmiCX5UtIXpFlMn3heoPJdb7gvQZ4U1b34og/9znJXFv
i8m1mmtmHqJaSFSYGtl4uYnaGCCV/OQLJ3bcWXMUiK20bHW0xCwOd2BHjKcFLvql
9rAH91e7CXTLPZCGMvyYWE6/i4svcEIuvYRn63/r6VyfXeo+rQ0afCmCcw1XCARW
rvF+P16pBdSe39BpFXSP57ZT6X7Ol0ws9eTurwGB/2R84rCKRg9vGGG6tIRxR0gp
YS9zxs0xm9eg5fucJhyadkEK560fiLiVme9OjqFk9HC/WgZVIlj1JMC5jUTeP4O3
wlGAxot0r1UJ+jOKkuRlq56ShC3s8Lr+D/fy6VbzjcoSwynKTymaMKFH0HROg2yA
IqRBQ0f/N9JezTlhMCIRLLkARGfSsYqwe4G8+xDPu3cUpsypDEd0zUxpq8v4bmR4
dUxSdezolr3EOf7zvJq22MDqh4dZmI08MPwSW0TLV2QT1HuZ7CgmvY5Y5dl4hjW1
eaTV5m7hrw==
=gLY0
-----END PGP SIGNATURE-----