Latest redhat build of quarkus Vulnerabilities

● CVE-2023-6393

Quarkus: potential invalid reuse of context when @cacheresult on a uni is used

redhat/quarkus<3.2.9.

redhat/quarkus<2.13.9.

Redhat Build Of Quarkus

maven/io.quarkus:quarkus-cache>=3.2.0.CR1<3.2.9.Final

maven/io.quarkus:quarkus-cache>=3.3.0.CR1<3.5.2

● CVE-2023-6394

Quarkus: graphql operations over websockets bypass

maven/io.quarkus:quarkus-smallrye-graphql-client-parent<2.13.9.Final

maven/io.quarkus:quarkus-smallrye-graphql-client-parent>=2.14.0<3.5.3

Quarkus Quarkus<3.6.0

Redhat Build Of Quarkus

redhat/quarkus<3.6.0

● CVE-2023-44487

- Rapid Reset HTTP/2 vulnerability

Microsoft Windows 11=21H2

Microsoft Windows Server 2022

Microsoft Windows 11=22H2

and 553 more

● CVE-2023-4853

Quarkus: http security policy bypass

maven/io.quarkus:quarkus-keycloak-authorization>=3.3.0<3.3.3

maven/io.quarkus:quarkus-keycloak-authorization>=3.0.0<3.2.6.Final

maven/io.quarkus:quarkus-keycloak-authorization<2.16.11.Final

maven/io.quarkus:quarkus-csrf-reactive>=3.3.0<3.3.3

maven/io.quarkus:quarkus-csrf-reactive>=3.0.0<3.2.6.Final

maven/io.quarkus:quarkus-csrf-reactive<2.16.11.Final

and 25 more

● CVE-2023-2974

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the ...

Redhat Build Of Quarkus<2.13.8

maven/io.quarkus:quarkus-core<2.16.8.Final

redhat/quarkus<2.13.8

● CVE-2023-1664

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5cc8-pgp5-7mpm. This link is maintained to preserve external references. ## Original Advisory A flaw was found...

Redhat Keycloak

Redhat Single Sign-on=7.0

Redhat Build Of Quarkus

Redhat Jboss A-mq=7

Redhat Migration Toolkit For Runtimes

redhat/rh-sso7-keycloak<0:18.0.8-1.redhat_00001.1.el7

and 4 more

● CVE-2023-1108

Infinite loop in sslconduit during close

redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el8ea

redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el8ea

redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea

redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea

redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el9ea

redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el9ea

and 39 more

● CVE-2023-0044

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to `/`, then a cross-site attack may be initiated, which might lead to information disclosure.

Quarkus Quarkus<2.13.7

Redhat Build Of Quarkus

redhat/quarkus-vertx-http<2.13.7

● CVE-2022-4492

Undertow could provide weaker than expected security, caused by not checking the server identity the server certificate presents in HTTPS connections. An attacker could exploit this vulnerability to l...

redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea

redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea

redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el9ea

redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el9ea

redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el7ea

redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el7ea

and 14 more

● CVE-2022-4116

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

Redhat Build Of Quarkus

Quarkus Quarkus<2.13.5

Quarkus Quarkus>=2.14.0<2.14.2

● CVE-2022-1259

Undertow is vulnerable to a denial of service, caused by a potential security issue in flow control over HTTP/2. By sending a specially-crafted packet, a remote attacker could exploit this vulnerabili...

redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el8ea

redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el9ea

redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el7ea

Redhat Build Of Quarkus

Redhat Integration Camel K

Redhat Jboss Enterprise Application Platform=7.0.0

and 12 more

● CVE-2022-1011

A flaw in the Linux Kernel found. If unprivileged users can mount FUSE filesystems, then can trigger use after free (UAF) that reads of write() buffers, allowing theft of (partial) /etc/shadow hashes ...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.17

Linux Linux kernel=5.17

Linux Linux kernel=5.17-rc1

Linux Linux kernel=5.17-rc2

and 181 more

● CVE-2021-4178

fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.

redhat/kubernetes-client<5.0.3

redhat/kubernetes-client<5.1.2

redhat/kubernetes-client<5.3.2

redhat/kubernetes-client<5.4.2

redhat/kubernetes-client<5.7.4

redhat/kubernetes-client<5.8.1

and 25 more

● CVE-2021-3914

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

Redhat Build Of Quarkus<2.7.5

Redhat Build Of Quarkus

Redhat Openshift Application Runtimes=1.0

Redhat Smallrye Health

maven/io.smallrye:smallrye-health-ui<3.1.2

● CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This v...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.15

Linux Linux kernel=5.15

Linux Linux kernel=5.15-rc1

Linux Linux kernel=5.15-rc2

and 157 more

● CVE-2021-3669

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel

IBM Spectrum Copy Data Management>=2.2.0.0<=2.2.15.0

IBM Spectrum Protect Plus>=10.1.0<=10.1.10.2

Linux Linux kernel

and 161 more

● CVE-2021-3642

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest th...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 47 more

● CVE-2021-3609

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This ...

Linux Linux kernel>=2.6.25<4.4.276

Linux Linux kernel>=4.5<4.9.276

Linux Linux kernel>=4.10<4.14.240

Linux Linux kernel>=4.15<4.19.198

Linux Linux kernel>=4.20<5.4.132

Linux Linux kernel>=5.5.0<5.10.50

and 241 more

● CVE-2021-3536

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affe...

redhat/Wildfly<23.0.2.

redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.15-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-3.SP1_redhat_00001.1.el6ea

redhat/eap7-infinispan<0:9.4.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.33-1.Final_redhat_00001.1.el6ea

and 45 more

● CVE-2021-20218

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to ext...

redhat/jenkins<2-plugins-0:4.7.1616671397-1.el8

Redhat Kubernetes-client>=4.2.0<4.7.2

Redhat Kubernetes-client>=4.8.0<4.11.2

Redhat Kubernetes-client>=4.12.0<4.13.2

Redhat Kubernetes-client>=5.0.0<5.0.2

Redhat A-mq Online

and 7 more

● CVE-2019-14900

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is use...

redhat/Hibernate ORM<5.3.18

redhat/Hibernate ORM<5.4.18

redhat/Hibernate ORM<5.5.0.

redhat/Hibernate ORM 5.3.17.Final-redhat<00001

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

and 125 more

Latest redhat build of quarkus Vulnerabilities

Company

Resources

Contact