ID

VAR-202101-0145


CVE

CVE-2020-17518


TITLE

Apache Flink  Traversal Vulnerability in Japan

Trust: 0.8

sources: JVNDB: JVNDB-2020-015210

DESCRIPTION

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master. Apache Flink Contains a path traversal vulnerability.Information may be tampered with. Apache Flink is an efficient and distributed general data processing platform. There is an arbitrary file writing vulnerability in Apache Flink products. Attackers can use this vulnerability to read sensitive files on the server, use hard-coded credentials to use the vulnerability to read and write HMI configuration files and reset the device. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Fuse 7.9.0 release and security update Advisory ID: RHSA-2021:3140-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2021:3140 Issue date: 2021-08-11 CVE Names: CVE-2017-5645 CVE-2017-18640 CVE-2019-12402 CVE-2019-14887 CVE-2019-16869 CVE-2019-20445 CVE-2020-1695 CVE-2020-1925 CVE-2020-1935 CVE-2020-1938 CVE-2020-5410 CVE-2020-5421 CVE-2020-6950 CVE-2020-9484 CVE-2020-10688 CVE-2020-10693 CVE-2020-10714 CVE-2020-10719 CVE-2020-11996 CVE-2020-13920 CVE-2020-13934 CVE-2020-13935 CVE-2020-13936 CVE-2020-13954 CVE-2020-13956 CVE-2020-14040 CVE-2020-14297 CVE-2020-14338 CVE-2020-14340 CVE-2020-17510 CVE-2020-17518 CVE-2020-25633 CVE-2020-25638 CVE-2020-25640 CVE-2020-25644 CVE-2020-26258 CVE-2020-26945 CVE-2020-27216 CVE-2020-28052 CVE-2021-27807 CVE-2021-27906 CVE-2021-28165 ===================================================================== 1. Summary: A minor version update (from 7.8 to 7.9) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.9.0 serves as a replacement for Red Hat Fuse 7.8, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * hawtio-osgi (CVE-2017-5645) * prometheus-jmx-exporter: snakeyaml (CVE-2017-18640) * apache-commons-compress (CVE-2019-12402) * karaf-transaction-manager-narayana: netty (CVE-2019-16869, CVE-2019-20445) * tomcat (CVE-2020-1935, CVE-2020-1938, CVE-2020-9484, CVE-2020-13934, CVE-2020-13935, CVE-2020-11996) * spring-cloud-config-server (CVE-2020-5410) * velocity (CVE-2020-13936) * httpclient: apache-httpclient (CVE-2020-13956) * shiro-core: shiro (CVE-2020-17510) * hibernate-core (CVE-2020-25638) * wildfly-openssl (CVE-2020-25644) * jetty (CVE-2020-27216, CVE-2021-28165) * bouncycastle (CVE-2020-28052) * wildfly (CVE-2019-14887, CVE-2020-25640) * resteasy-jaxrs: resteasy (CVE-2020-1695) * camel-olingo4 (CVE-2020-1925) * springframework (CVE-2020-5421) * jsf-impl: Mojarra (CVE-2020-6950) * resteasy (CVE-2020-10688) * hibernate-validator (CVE-2020-10693) * wildfly-elytron (CVE-2020-10714) * undertow (CVE-2020-10719) * activemq (CVE-2020-13920) * cxf-core: cxf (CVE-2020-13954) * fuse-apicurito-operator-container: golang.org/x/text (CVE-2020-14040) * jboss-ejb-client: wildfly (CVE-2020-14297) * xercesimpl: wildfly (CVE-2020-14338) * xnio (CVE-2020-14340) * flink: apache-flink (CVE-2020-17518) * resteasy-client (CVE-2020-25633) * xstream (CVE-2020-26258) * mybatis (CVE-2020-26945) * pdfbox (CVE-2021-27807, CVE-2021-27906) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.9.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability 1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class 1758619 - CVE-2019-16869 netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers 1764640 - CVE-2019-12402 apache-commons-compress: Infinite loop in name encoding algorithm 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use 1785376 - CVE-2017-18640 snakeyaml: Billion laughs attack via alias feature 1790309 - CVE-2020-1925 olingo-odata: Server side request forgery in AsyncResponseWrapperImpl 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1805006 - CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling 1814974 - CVE-2020-10688 RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack 1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication 1828459 - CVE-2020-10719 undertow: invalid HTTP request with large chunk size 1838332 - CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE 1845626 - CVE-2020-5410 spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack 1851420 - CVE-2020-11996 tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service 1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS 1857040 - CVE-2020-13934 tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS 1860054 - CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl 1860218 - CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS 1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling 1880101 - CVE-2020-13920 activemq: improper authentication allows MITM attack 1881158 - CVE-2020-5421 springframework: RFD protection bypass via jsessionid 1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used 1881637 - CVE-2020-25640 wildfly: resource adapter logs plaintext JMS password at warning level on connection error 1885485 - CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL 1886587 - CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs 1887257 - CVE-2020-26945 mybatis: mishandles deserialization of object streams which could result in remote code execution 1891132 - CVE-2020-27216 jetty: local temporary directory hijacking vulnerability 1898235 - CVE-2020-13954 cxf: XSS via the styleSheetPath 1903727 - CVE-2020-17510 shiro: specially crafted HTTP request may cause an authentication bypass 1908832 - CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling 1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible 1913312 - CVE-2020-17518 apache-flink: directory traversal attack allows remote file writing through the REST API 1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates 1941050 - CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file 1941055 - CVE-2021-27807 pdfbox: infinite loop while loading a crafted PDF file 1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame 5. References: https://access.redhat.com/security/cve/CVE-2017-5645 https://access.redhat.com/security/cve/CVE-2017-18640 https://access.redhat.com/security/cve/CVE-2019-12402 https://access.redhat.com/security/cve/CVE-2019-14887 https://access.redhat.com/security/cve/CVE-2019-16869 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-1695 https://access.redhat.com/security/cve/CVE-2020-1925 https://access.redhat.com/security/cve/CVE-2020-1935 https://access.redhat.com/security/cve/CVE-2020-1938 https://access.redhat.com/security/cve/CVE-2020-5410 https://access.redhat.com/security/cve/CVE-2020-5421 https://access.redhat.com/security/cve/CVE-2020-6950 https://access.redhat.com/security/cve/CVE-2020-9484 https://access.redhat.com/security/cve/CVE-2020-10688 https://access.redhat.com/security/cve/CVE-2020-10693 https://access.redhat.com/security/cve/CVE-2020-10714 https://access.redhat.com/security/cve/CVE-2020-10719 https://access.redhat.com/security/cve/CVE-2020-11996 https://access.redhat.com/security/cve/CVE-2020-13920 https://access.redhat.com/security/cve/CVE-2020-13934 https://access.redhat.com/security/cve/CVE-2020-13935 https://access.redhat.com/security/cve/CVE-2020-13936 https://access.redhat.com/security/cve/CVE-2020-13954 https://access.redhat.com/security/cve/CVE-2020-13956 https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/cve/CVE-2020-14297 https://access.redhat.com/security/cve/CVE-2020-14338 https://access.redhat.com/security/cve/CVE-2020-14340 https://access.redhat.com/security/cve/CVE-2020-17510 https://access.redhat.com/security/cve/CVE-2020-17518 https://access.redhat.com/security/cve/CVE-2020-25633 https://access.redhat.com/security/cve/CVE-2020-25638 https://access.redhat.com/security/cve/CVE-2020-25640 https://access.redhat.com/security/cve/CVE-2020-25644 https://access.redhat.com/security/cve/CVE-2020-26258 https://access.redhat.com/security/cve/CVE-2020-26945 https://access.redhat.com/security/cve/CVE-2020-27216 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2021-27807 https://access.redhat.com/security/cve/CVE-2021-27906 https://access.redhat.com/security/cve/CVE-2021-28165 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.9.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYRQVh9zjgjWX9erEAQjAxg/+O0wRNyDejQCX7SWv2Lvo5YZVE9Azv+hd pWFbtNu1cruoiUWY2vqArIH8KmZXWYS/EDQCe4PfIB0wKZfx9dS7y19Ct4swE4Y2 3L0DRVp9YLoqZC3ndVIk3W+RSLEODc5S3IAi6twXlmiZlAwPJXDvcs7aeUAPGc0m 93Y3lZofrpaEnyEVdoUsz0M47mQQYxNJ1nPF9FuUDsOXUqiu18JS9DsuyWwONyKw dPCxfHf3ioI+ymsYjoO+fIcu3dR6lGryvsEFY3dnXePiLlp5NBrRW359K6EQGM/e f1PsXzVYrWMikmxpGaOM7KkoLPAcvtznd4G62ZGUODyAEUKLderr9M7zG88Eg2gG Ycw5D4UkJ+QZB/qHlQJHLrrzuPybGBXSdl2VLTF/m7YZSE9C2yW1ZatyahhdEP3T +MmzU6mnbuPCrYjwL/AgCGx3ap52+2eL5HvDzf7+5plY6MVpHZQb2iiIj6H58P6g ffxr6dGJdDtw5ovzls0Gor4sb69KJ+3xrRLg2C7cndd+3RJc8SCiCRUV9QE2IHTb H3cDXlNbYcqzDxQZNUUO13+GOEgXQLrIJokA3zNXzzYFr2tivmiWF6rKrJ6UnECl 86tpZfh4vcosv3nN6Cg9VAizrMm/84B4L3T4jm/mrN4SGg3CSJqa03r7ig3+oHFX H9jzBVxbmuk= =jp7z -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4

Trust: 2.52

sources: NVD: CVE-2020-17518 // JVNDB: JVNDB-2020-015210 // CNVD: CNVD-2021-07119 // VULMON: CVE-2020-17518 // PACKETSTORM: 163798 // PACKETSTORM: 163874 // PACKETSTORM: 163872

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-07119

AFFECTED PRODUCTS

vendor:apachemodel:flinkscope:gteversion:1.5.1

Trust: 1.0

vendor:apachemodel:flinkscope:ltversion:1.11.3

Trust: 1.0

vendor:apachemodel:flinkscope:eqversion: -

Trust: 0.8

vendor:apachemodel:flinkscope:eqversion:1.5.1

Trust: 0.8

vendor:apachemodel:flinkscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-07119 // JVNDB: JVNDB-2020-015210 // NVD: CVE-2020-17518

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-17518
value: HIGH

Trust: 1.0

NVD: CVE-2020-17518
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-07119
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202101-273
value: HIGH

Trust: 0.6

VULMON: CVE-2020-17518
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-17518
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-07119
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-17518
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-17518
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-07119 // VULMON: CVE-2020-17518 // JVNDB: JVNDB-2020-015210 // CNNVD: CNNVD-202101-273 // NVD: CVE-2020-17518

PROBLEMTYPE DATA

problemtype:CWE-23

Trust: 1.0

problemtype:CWE-22

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-015210 // NVD: CVE-2020-17518

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 163798 // CNNVD: CNNVD-202101-273

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202101-273

PATCH

title:[jira] [Created] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10url:https://lists.apache.org/thread.html/r0b000dc028616d33cb9aa388eb45d516b789cab0024dad94bc06588a@%3Cissues.flink.apache.org%3E

Trust: 0.8

title:Patch for Apache Flink arbitrary file writing vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/243640

Trust: 0.6

title:Apache Flink Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138920

Trust: 0.6

title:Flink-CVE-2020-17518-getshellurl:https://github.com/rakjong/Flink-CVE-2020-17518-getshell

Trust: 0.1

sources: CNVD: CNVD-2021-07119 // VULMON: CVE-2020-17518 // JVNDB: JVNDB-2020-015210 // CNNVD: CNNVD-202101-273

EXTERNAL IDS

db:NVDid:CVE-2020-17518

Trust: 3.4

db:OPENWALLid:OSS-SECURITY/2021/01/05/1

Trust: 2.2

db:JVNDBid:JVNDB-2020-015210

Trust: 0.8

db:PACKETSTORMid:163798

Trust: 0.7

db:PACKETSTORMid:163872

Trust: 0.7

db:CNVDid:CNVD-2021-07119

Trust: 0.6

db:AUSCERTid:ESB-2021.2816

Trust: 0.6

db:AUSCERTid:ESB-2021.2731

Trust: 0.6

db:CNNVDid:CNNVD-202101-273

Trust: 0.6

db:VULMONid:CVE-2020-17518

Trust: 0.1

db:PACKETSTORMid:163874

Trust: 0.1

sources: CNVD: CNVD-2021-07119 // VULMON: CVE-2020-17518 // JVNDB: JVNDB-2020-015210 // PACKETSTORM: 163798 // PACKETSTORM: 163874 // PACKETSTORM: 163872 // CNNVD: CNNVD-202101-273 // NVD: CVE-2020-17518

REFERENCES

url:http://www.openwall.com/lists/oss-security/2021/01/05/1

Trust: 2.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-17518

Trust: 1.7

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261%40%3cdev.flink.apache.org%3e

Trust: 1.6

url:https://lists.apache.org/thread.html/rec0d650fbd4ea1a5e1224a347d83a63cb44291c334ad58b8809bc23b%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rf8812a5703f4a5f1341138baf239258b250875699732cfdf9d55b21d%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r4a87837518804b31eb9db3048347ed2bb7b46fbaad5844f22a9fd4dc%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r5444acac3407ef6397d6aef1b5aec2db53b4b88ef221e63084c1e5f2%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rd6a1a0e2d73220a65a8f6535bbcd24bb66adb0d046c4a1aa18777cf3%40%3cdev.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3cdev.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r88200d2f0b620c6b4b1585a7171355005c89e678b01d0e71a16c57e7%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3cuser-zh.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r705fb2211b82c9f1f8d2b1d4c823bcbca50402ba09b96608ec657efe%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r710693b0d3b229c81f485804ea1145b4edda79c9e77d66c39a0a2ff1%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r7b2ee88c66fc1d0823e66475631f5c3e7f0365204ff0cb094d9f2433%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3cannounce.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rcb9e8af775f2a3706b69153aefde78f208871649df057c70ce2e24f9%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r0b000dc028616d33cb9aa388eb45d516b789cab0024dad94bc06588a%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3cdev.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rfe159ccf496d75813f24c6079c5d33872d83f5a2e39cb32c3aef5a73%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3cannounce.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261%40%3cannounce.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rd2467344f88bcaf108b8209ca92da8ec393c68174bfb8c27d1e20faa%40%3cdev.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261%40%3cuser.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r8167f30c4c60a11b8d5be3f55537beeda629be61196e693bde403b36%40%3cissues.flink.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rd6a1a0e2d73220a65a8f6535bbcd24bb66adb0d046c4a1aa18777cf3@%3cdev.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r88200d2f0b620c6b4b1585a7171355005c89e678b01d0e71a16c57e7@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r710693b0d3b229c81f485804ea1145b4edda79c9e77d66c39a0a2ff1@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r4a87837518804b31eb9db3048347ed2bb7b46fbaad5844f22a9fd4dc@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d@%3cuser-zh.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r705fb2211b82c9f1f8d2b1d4c823bcbca50402ba09b96608ec657efe@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r8167f30c4c60a11b8d5be3f55537beeda629be61196e693bde403b36@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r5444acac3407ef6397d6aef1b5aec2db53b4b88ef221e63084c1e5f2@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3cannounce.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rf8812a5703f4a5f1341138baf239258b250875699732cfdf9d55b21d@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rfe159ccf496d75813f24c6079c5d33872d83f5a2e39cb32c3aef5a73@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3cannounce.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f@%3cdev.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rd2467344f88bcaf108b8209ca92da8ec393c68174bfb8c27d1e20faa@%3cdev.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r7b2ee88c66fc1d0823e66475631f5c3e7f0365204ff0cb094d9f2433@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3cannounce.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3cdev.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1@%3cdev.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r0b000dc028616d33cb9aa388eb45d516b789cab0024dad94bc06588a@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3cuser.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rec0d650fbd4ea1a5e1224a347d83a63cb44291c334ad58b8809bc23b@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/rcb9e8af775f2a3706b69153aefde78f208871649df057c70ce2e24f9@%3cissues.flink.apache.org%3e

Trust: 0.6

url:https://packetstormsecurity.com/files/163872/red-hat-security-advisory-2021-3205-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2731

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2816

Trust: 0.6

url:https://packetstormsecurity.com/files/163798/red-hat-security-advisory-2021-3140-01.html

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-13920

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-13920

Trust: 0.3

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.3

url:https://access.redhat.com/security/team/contact/

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-17518

Trust: 0.3

url:https://bugzilla.redhat.com/):

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-27807

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-27906

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-28052

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-20218

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-29582

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-20218

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-27222

Trust: 0.2

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=red.hat.integration&version=2021-q3

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-17521

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-17521

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27222

Trust: 0.2

url:https://access.redhat.com/articles/11258

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-27782

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-29582

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-26238

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27782

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-26238

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-13936

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-6950

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1935

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-17510

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13956

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14040

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14338

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13954

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2017-18640

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14040

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:3140

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-5410

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13934

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-27216

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10688

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13934

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14887

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13935

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-28165

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-9484

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14297

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-5645

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14338

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10693

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1695

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10714

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11996

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12402

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12402

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13954

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-26258

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25640

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25638

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2017-5645

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14340

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.fuse&version=7.9.0

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14297

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-17510

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11996

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10719

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13956

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-16869

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14340

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25633

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-16869

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-18640

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-26945

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25644

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1935

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13936

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-5421

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1938

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1938

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-20445

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-20445

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10719

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10693

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10688

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13935

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1695

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14887

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10714

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:3207

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_integration/2021.q3/html-single/getting_started_with_camel_quarkus_extensions/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-27906

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30468

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30468

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-31811

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-27807

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_integration/2021.q3/html/getting_started_with_camel_k/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-31811

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-28052

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:3205

Trust: 0.1

sources: CNVD: CNVD-2021-07119 // JVNDB: JVNDB-2020-015210 // PACKETSTORM: 163798 // PACKETSTORM: 163874 // PACKETSTORM: 163872 // CNNVD: CNNVD-202101-273 // NVD: CVE-2020-17518

CREDITS

Red Hat

Trust: 0.3

sources: PACKETSTORM: 163798 // PACKETSTORM: 163874 // PACKETSTORM: 163872

SOURCES

db:CNVDid:CNVD-2021-07119
db:VULMONid:CVE-2020-17518
db:JVNDBid:JVNDB-2020-015210
db:PACKETSTORMid:163798
db:PACKETSTORMid:163874
db:PACKETSTORMid:163872
db:CNNVDid:CNNVD-202101-273
db:NVDid:CVE-2020-17518

LAST UPDATE DATE

2024-11-23T20:51:13.606000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-07119date:2021-01-28T00:00:00
db:VULMONid:CVE-2020-17518date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2020-015210date:2021-09-14T09:04:00
db:CNNVDid:CNNVD-202101-273date:2021-08-20T00:00:00
db:NVDid:CVE-2020-17518date:2024-11-21T05:08:16.340

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-07119date:2021-01-28T00:00:00
db:VULMONid:CVE-2020-17518date:2021-01-05T00:00:00
db:JVNDBid:JVNDB-2020-015210date:2021-09-14T00:00:00
db:PACKETSTORMid:163798date:2021-08-12T15:42:56
db:PACKETSTORMid:163874date:2021-08-18T15:25:13
db:PACKETSTORMid:163872date:2021-08-18T15:23:11
db:CNNVDid:CNNVD-202101-273date:2021-01-05T00:00:00
db:NVDid:CVE-2020-17518date:2021-01-05T12:15:12.367