RHSA-2024:9571MediumCVSS 7.5

Red Hat Security Advisory: Streams for Apache Kafka 2.8.0 release and security update

Published
November 13, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2024-47554 →CVE-2024-7254 →CVE-2024-8184 →CVE-2024-8285 →CVE-2024-9823 →CVE-2024-29025 →

📋 Description

CVE-2024-7254 — protobuf: StackOverflow vulnerability in Protocol Buffers CVE-2024-8184 — org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks CVE-2024-8285 — kroxylicious: Missing upstream Kafka TLS hostname verification CVE-2024-9823 — org.eclipse.jetty:jetty-servlets: jetty: Jetty DOS vulnerability on DosFilter CVE-2024-29025 — netty-codec-http: Allocation of Resources Without Limits or Throttling CVE-2024-47554 — apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

🎯 Affected products1

  • Streams for Apache Kafka 2.8.0

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (33)