RHSA-2024:4326: Moderate: Red Hat build of Quarkus 3.8.5 release and security update
This release of Red Hat build of Quarkus 3.8.5 includes security updates, bug fixes and enhancements. For more information, see the release notes page listed in the References section.Security Fix(es): (CVE-2024-29857) org.bouncycastle:bcprov-jdk18on: org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service [quarkus-3.8] (CVE-2024-30172) org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class [quarkus-3.8] (CVE-2024-34447) org.bouncycastle/bcprov-jdk18on: org.bouncycastle: Use of Incorrectly-Resolved Name or Reference [quarkus-3.8] (CVE-2024-30171) org.bouncycastle-bcprov-jdk18on: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack) [quarkus-3.8]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:4326?
The severity of RHSA-2024:4326 is classified as critical due to the potential impact of the vulnerabilities it addresses.
How do I fix RHSA-2024:4326?
To fix RHSA-2024:4326, you should update to the latest version of the Red Hat Quarkus build as specified in the release notes.
What vulnerabilities are addressed in RHSA-2024:4326?
RHSA-2024:4326 addresses security vulnerabilities including CVE-2024-29857 related to org.bouncycastle:bcprov-jdk18on.
Is RHSA-2024:4326 applicable to all versions of Red Hat Quarkus?
RHSA-2024:4326 is specifically applicable to the affected version of Red Hat Quarkus and its components as outlined in the advisory.
Where can I find more information about RHSA-2024:4326?
More information about RHSA-2024:4326 can be found in the Red Hat advisory and related Bugzilla entries.