Distribution Fixed Security Vulnerabilities

High

TBD

Package being upgraded. CVE requires an authenticated user to be exploited

Medium

2.33.0

Upgraded Apache Commons Lang to a fixed version.

High

2.31.2

Upgraded Apache Tomcat to a fixed version.

High

2.31.1

Upgraded Apache Tomcat to a fixed version.

Critical

2.30.0

Upgraded Apache Tomcat to a fixed version.

High

2.29.1

Upgraded Apache Tomcat to a fixed version.

High

2.29.1

Upgraded Golang to a fixed version.

Medium

2.29.1

Upgraded Spring Security to a fixed version.

Medium

2.29.1

Upgraded logback-core to a fixed version.

High

2.28.1

Upgraded ag-grid-community and ag-grid-enterprise due to a prototype pollution via the _.mergeDeep function.

High

2.27.2

Upgraded java_commons to a fixed version.

High

2.27.2

Upgraded Traefik to a fixed version due to a vulnerability that allows the bypassing of IP allow-lists.

Medium

2.26.1

Upgraded Bouncy Castle to a fixed version because of an issue discovered in Java Cryptography APIs.

Medium

2.26.1

Upgraded Bouncy Castle to a fixed version because of an issue discovered in Java TLS API and JSSE Provider.

Medium

2.26.1

Upgraded Bouncy Castle to a fixed version because of an issue discovered in ECCurve.java and ECCurve.cs.

High

2.24.0

Upgraded Spring Framework to a fixed version.

Critical

2.23.0

Upgraded pgjdbc to a fixed version.

High

2.23.0

Upgraded Spring Framework to a fixed version.

High

2.23.0

Upgraded UriComponentsBuilder to a fixed version.

Medium

2.23.0

Upgraded Apache Commons Compress to a fixed version.

Medium

2.23.0

Upgraded IPAddress to a fixed version.

High

2.22.1

Upgraded Traefik to a fixed version.

High

2.22.1

Upgraded Apache Tomcat to a fixed version.

High

2.22.1

Upgraded logback to a fixed version.

High

2.21.3

Upgraded the Hot Rod client to a fixed version.

Medium

2.21.3

Upgraded jackson-databind to a fixed version.

Medium

2.21.3

Upgraded Apache Tomcat to a fixed version.

Medium

2.21.3

Upgraded Spring Framework to a fixed version.

Medium

2.19.1

Upgraded sanitize-url to a fixed version.

Medium

2.33.0

Upgraded Connect2id Nimbus JOSE + JWT to a fixed version.

Critical

2.30.1

Upgraded Apache Tomcat to a fixed version.

High

2.30.1

Upgraded Apache HttpClient to a fixed version.

Medium

2.30.0

Upgraded Netty to a fixed version.

Medium

2.29.1

Upgraded Netty to a fixed version.

Medium

2.28.1

Upgraded nanoid to a fixed version.

High

2.28.1

Does not affect Distribution as the vulnerable commons functionality is not in use.

Medium

2.28.1

Upgraded Netty to a fixed version.

Critical

2.28.1

Upgraded Spring Security to a fixed version.

Medium

2.28.1

Upgraded DataBinder to a fixed version.

High

2.28.1

Upgraded Spring Framework to a fixed version due to a vulnerability to path traversal attacks.

High

2.28.1

Upgraded Protobuf to a fixed version.

High

2.27.2

Upgraded Spring Framework to a fixed version due to a vulnerability to path traversal attacks.

Critical

2.27.2

Upgraded observability to a fixed version.

High

2.26.1

Upgraded Amazon Ion to a fixed version.

High

2.25.1

Upgraded Spring Framework to a fixed version.

Medium

2.24.0

Upgraded Bouncy Castle to a fixed version.

Medium

2.24.0

Upgraded Netty to a fixed version.

High

2.24.0

Upgraded Spring Security to a fixed version.

Medium

2.21.3

Upgraded netty-handler to a fixed version.

High

2.21.3

Upgraded netty-codec-http2 to a fixed version.

Medium

2.20.2

Upgraded Netty to a fixed version.

High

2.20.1

Upgraded Google Guava to a fixed version.

High

2.19.1

Upgraded fast-xml-parser to a fixed version.

Medium

2.19.1

Upgraded Spring Vault core to a fixed version.

High

2.18.1

Upgraded to a fixed version.

Medium

2.18.1

Upgraded the SnakeYAML library to a fixed version.

Critical

2.18.1

Upgraded Spring Boot to a fixed version.

Medium

2.18.1

Upgraded Spring Framework to a fixed version.

Critical

2.18.1

Upgraded Spring Security to a fixed version.

High

2.18.1

Upgraded to a fixed version.

High

N/A

This dependency is used in the development process only and does not impact the final product.

Medium

N/A

Upgraded to a fixed version.

High

N/A

Distribution doesn’t use the API related to this vulnerability.

High

N/A

Updated the UI common library.

High

N/A

This dependency is used in the development process only and is not included in the final product deployment.

High

N/A

Distribution does not use the vulnerable API.

Medium

N/A

Updating the drivers to 42.5.1 fixed the vulnerability.

Critical

N/A

Upgraded to a fixed version, although Distribution does not use the vulnerable API.

Critical

N/A

Upgraded to a fixed version.

High

N/A

Upgraded to a fixed version.

High

N/A

Upgraded to a fixed version.

Medium

N/A

Upgraded to a fixed version.

Medium

N/A

Upgraded to a fixed version.

Critical

N/A

Does not affect Distribution since Distribution does not use the potentially-harmful constructor.

High

N/A

Does not affect Distribution since the product uses Tomcat version 9.0.58 and doesn’t redefine rejectIllegalHeader, so its effective value is “true“ (default).

Critical

N/A

Does not affect Distribution since Distribution is not using the vulnerable API.

High

N/A

Upgraded spring-security-web to version 5.7.0.

Medium

N/A

Upgraded spring-context to version 5.3.21.

Medium

N/A

Upgraded spring-beans to version 5.3.21.

Critical

N/A

Does not affect Distribution, since Distribution uses 64-bit Redis and the issue affects only on a 32-bit system or as a 32-bit Redis executable running on a 64-bit system.

High

2.12.3

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Medium

2.12.0

pgjdbc, the official PostgreSQL JDBC Driver, has been upgraded to version 42.2.25.

Medium

2.11.0

Upgraded the logback.xml to version 1.2.9.

Medium

N/A

Does not affect Distribution, since the vulnerability only impacts applications running on Java version 6 and lower.