Threats Tagged 'cve-2025-24970'

Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Security Fix(es): * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) (CVE-2024-57699) * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length (CVE-2025-22228) * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948) * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999) * jenkins-2-plugins: jackson-core Potential StackoverflowError (CVE-2025-52999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

HawtIO 4.2.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. * path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x (CVE-2024-52798); * io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling (CVE-2024-12397); * ParsePKCS1PrivateKey panic with partial keys in crypto/x509 (CVE-2025-22866); * io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970); * json-smart: Potential DoS via stack exhaustion (CVE-2024-57699).

Camel K 1.10.10 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE important page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.22 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.21, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.22 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970) * io.netty/netty: Denial of Service attack on windows app using Netty (CVE-2024-47535) * netty-common: Denial of Service attack on windows app using Netty (CVE-2025-25193) * org.wildfly.core/wildfly-server: Wildfly improper RBAC permission (CVE-2025-23367) For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4. Security Fix(es): * io.netty/netty: Denial of Service attack on windows app using Netty (CVE-2024-47535) * netty-common: Denial of Service attack on windows app using Netty (CVE-2025-25193) * io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970) * org.wildfly.core/wildfly-server: Wildfly improper RBAC permission (CVE-2025-23367) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4. Security Fix(es): * io.netty/netty: Denial of Service attack on windows app using Netty (CVE-2024-47535) * netty-common: Denial of Service attack on windows app using Netty (CVE-2025-25193) * io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970) * org.wildfly.core/wildfly-server: Wildfly improper RBAC permission (CVE-2025-23367) * hornetq-core-client: Arbitrarily overwrite files or access sensitive information Security (CVE-2024-51127) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Data Grid versions prior to 8.5.3 contain two security vulnerabilities: CVE-2025-0736, which exposes sensitive information in application logs, and CVE-2025-24970, where improper packet validation in SslHandler can cause native crashes when using native SSLEngine. Red Hat has released Data Grid 8.5.3 to address these issues. The update is rated as important by Red Hat Product Security.

Release of RHOAI 2.18.0 provides these changes:

This release of Red Hat Build of Quarkus 3.15.3.SP1 includes security updates. For more information, see the release notes page listed in the References section. Security Fix(es): * io.netty/netty-handler: SslHandler doesn't correctly validate packets, which can lead to a native crash when using native SSLEngine (CVE-2025-24970) * io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247) * io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)

This release of Red Hat build of Quarkus 3.8.6.SP3 contains security updates. For more information, see the release notes page listed in the References section. Security Fix(es): * io.netty/netty-handler: SslHandler doesn't correctly validate packets, which can lead to a native crash when using native SSLEngine (CVE-2025-24970) * io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247) * io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)