Threats Tagged 'cve-2024-8285'

Red Hat build of Apache Camel 4.8 for Spring Boot release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * org.apache.kafka/kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider (CVE-2024-31141) * org.springframework/spring-webmvc: Path traversal vulnerability in functional web frameworks (CVE-2024-38819) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-8285