Latest Quarkus Vulnerabilities

● CVE-2023-6394

Quarkus: graphql operations over websockets bypass

maven/io.quarkus:quarkus-smallrye-graphql-client-parent<2.13.9.Final

maven/io.quarkus:quarkus-smallrye-graphql-client-parent>=2.14.0<3.5.3

Quarkus Quarkus<3.6.0

Redhat Build Of Quarkus

redhat/quarkus<3.6.0

● CVE-2023-6267

Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

Quarkus Quarkus<2.13.9

Quarkus Quarkus>=3.0.0<3.2.9

Quarkus Quarkus=2.13.9

Quarkus Quarkus=3.2.9

maven/io.quarkus.resteasy.reactive:resteasy-reactive>=3.0.0.Final<3.2.9.Final

maven/io.quarkus.resteasy.reactive:resteasy-reactive<2.13.9.Final

and 4 more

● CVE-2023-5720

Quarkus: build env information disclosure via gradle plugin

maven/io.quarkus:quarkus-project>=3.0.0.CR1<=3.5.1

Quarkus Quarkus>=3.0.1

Quarkus Quarkus=3.0.0-candidate_release1

Quarkus Quarkus=3.0.0-candidate_release2

Quarkus Quarkus>=3.0.1<3.2.8

● CVE-2023-4853

Quarkus: http security policy bypass

redhat/openshift-serverless-clients<0:1.9.2-3.el8

Quarkus Quarkus<2.16.11

Quarkus Quarkus>=3.2.0<3.2.6

Quarkus Quarkus>=3.3.0<3.3.3

Redhat Build Of Optaplanner=8.0

Redhat Build Of Quarkus>=2.13.0<2.13.8

and 28 more

● CVE-2023-1584

Quarkus-oidc: id and access tokens leak via the authorization code flow

maven/io.quarkus:quarkus-oidc>=3.0.0<3.1.0.Final

maven/io.quarkus:quarkus-oidc<2.13.0.Final

Quarkus Quarkus<2.13.8

redhat/quarkus-oidc<3.1.0.

<2.13.8

● CVE-2023-0481

In Quarkus' RESTEasy Reactive component, usage of File.createTempFile() class in the FileBodyHandler class causes temp files to be created with -rw-r--r-- permissions.

Quarkus Quarkus<2.16.1

maven/io.quarkus.resteasy.reactive:resteasy-reactive-common<3.0.0.Alpha4

redhat/quarkus<2.16.1

● CVE-2023-0044

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to `/`, then a cross-site attack may be initiated, which might lead to information disclosure.

Quarkus Quarkus<2.13.7

Redhat Build Of Quarkus

redhat/quarkus-vertx-http<2.13.7

● CVE-2022-4147

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on th...

Quarkus Quarkus>=2.0<2.13.5

Quarkus Quarkus>=2.14.0<2.14.2

● CVE-2022-4116

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

Redhat Build Of Quarkus

Quarkus Quarkus<2.13.5

Quarkus Quarkus>=2.14.0<2.14.2

● CVE-2022-42003

A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive...

redhat/jenkins<2-plugins-0:4.11.1686831822-1.el8

redhat/jenkins<2-plugins-0:4.12.1675702407-1.el8

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el9ea

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el7ea

redhat/candlepin<0:4.1.19-1.el7

and 64 more

● CVE-2022-42004

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent t...

debian/jackson-databind<=2.9.8-3+deb10u3

redhat/jenkins<2-plugins-0:4.11.1686831822-1.el8

redhat/jenkins<2-plugins-0:4.12.1675702407-1.el8

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el9ea

redhat/eap7-jackson-databind<0:2.12.7-1.redhat_00003.1.el7ea

and 14 more

● CVE-2022-2466

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.

Quarkus Quarkus>=2.10.0<2.10.4

● CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operation...

redhat/quarkus<2.7.1.

Quarkus Quarkus<2.7.1

● CVE-2022-21724

PostgreSQL JDBC Driver (PgJDBC) could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sendin...

IBM Disconnected Log Collector<=v1.0 - v1.8.2

Postgresql Postgresql Jdbc Driver<42.2.25

Postgresql Postgresql Jdbc Driver>=42.3.0<42.3.2

Postgresql Postgresql Jdbc Driver=42.3.2-rc1

Fedoraproject Fedora=35

Quarkus Quarkus<2.7.2

and 4 more

● CVE-2022-21363

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privil...

redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el8ea

redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el7ea

Oracle Mysql Connectors>=8.0.0<=8.0.27

Quarkus Quarkus<2.7.0

● CVE-2021-43797

### Impact Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to...

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea

redhat/candlepin<0:4.1.13-1.el7

redhat/candlepin<0:4.1.13-1.el8

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 60 more

● CVE-2021-2471

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privil...

redhat/MySQL Connector/J<8.0.27

Oracle Communications Cloud Native Core Console=1.9.0

Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0

Oracle Communications Cloud Native Core Policy=1.15.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=1.7.0

Oracle Mysql Connectors>=8.0.0<=8.0.26

and 2 more

● CVE-2021-38153

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful...

maven/org.apache.kafka:kafka-clients=2.8.0

maven/org.apache.kafka:kafka-clients>=2.7.0<2.7.2

maven/org.apache.kafka:kafka-clients>=2.0.0<2.6.3

maven/org.apache.kafka:kafka_2.13=2.8.0

maven/org.apache.kafka:kafka_2.13>=2.7.0<2.7.2

maven/org.apache.kafka:kafka_2.13>=2.4.0<2.6.3

and 26 more

● CVE-2021-37136

### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users o...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec<4.1.68.Final

Netty Netty<4.1.68

Quarkus Quarkus<2.2.4

Oracle Banking Apis>=18.1<=18.3

and 44 more

● CVE-2021-37137

### Impact The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk ...

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea

redhat/candlepin<0:4.1.15-1.el8

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec>=4.0.0<4.1.68.Final

and 61 more

● CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, ...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 55 more

● CVE-2021-3642

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest th...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 47 more

● CVE-2021-26291

A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious act...

maven/org.apache.maven:maven-core<3.8.1

maven/org.apache.maven:maven-compat<3.8.1

redhat/jenkins<2-plugins-0:4.11.1683009941-1.el8

Apache Maven<3.8.1

Quarkus Quarkus<1.13.5

Oracle Financial Services Analytical Applications Infrastructure>=8.0.6.0.0<=8.0.9.0.0

and 6 more

● CVE-2021-29429

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to...

Gradle Gradle<7.0

Quarkus Quarkus<=2.2.3

● CVE-2021-29427

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Grad...

Gradle Gradle>=5.1<7.0

Quarkus Quarkus<=2.2.3

● CVE-2021-29428

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds co...

Gradle Gradle<7.0

Quarkus Quarkus<=2.2.3

● CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 40 more

● CVE-2021-21409

### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec-http2>=4.0.0<4.1.61.Final

redhat/qpid-proton<0:0.33.0-6.el7_9

redhat/qpid-proton<0:0.33.0-8.el8

redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea

and 75 more

● CVE-2021-21295

### Impact If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is n...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec-http2>=4.0.0<4.1.60.Final

redhat/qpid-proton<0:0.33.0-6.el7_9

redhat/qpid-proton<0:0.33.0-8.el8

redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea

and 78 more

● CVE-2021-20289

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the r...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 44 more

● CVE-2020-28491

FasterXML jackson-dataformats-binary is vulnerable to a denial of service, caused by an unchecked allocation of byte buffer flaw. By sending a specially-crafted request, a remote attacker could exploi...

FasterXML jackson-dataformats-binary<2.11.4

FasterXML jackson-dataformats-binary>2.12.0<2.12.1

FasterXML jackson-dataformats-binary=2.12.0

FasterXML jackson-dataformats-binary=2.12.0-rc1

FasterXML jackson-dataformats-binary=2.12.0-rc2

Quarkus Quarkus<2.0.2

and 8 more

● CVE-2021-20328

MongoDB Java driver client-side field level encryption not verifying KMS host name

Mongodb Java Driver>=3.11.0<3.11.3

Mongodb Java Driver>=3.12.0<3.12.8

Mongodb Java Driver>=4.0.0<4.0.6

Mongodb Java Driver>=4.1.0<4.1.2

Mongodb Java Driver>=4.2.0<4.2.1

Quarkus Quarkus<1.13.3

and 20 more

● CVE-2021-21290

### Impact When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. The CVSSv3.1 ...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec-http>=4.0.0<4.1.59.Final

redhat/qpid-proton<0:0.33.0-6.el7_9

redhat/qpid-proton<0:0.33.0-8.el8

redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea

and 91 more

● CVE-2020-25724

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerabil...

redhat/resteasy<2.0.0.

Redhat Resteasy<2.0.0

Redhat Resteasy=2.0.0-alpha1

Redhat Resteasy=2.0.0-alpha2

Quarkus Quarkus<1.11.2

● CVE-2020-13956

Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the improper handling of malformed authority component in request URIs. By passing request URIs to the librar...

redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea

redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea

and 88 more

● CVE-2020-25638

A flaw was found in Hibernate ORM of all versions before and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is use...

redhat/eap7-hibernate<0:5.3.18-2.Final_redhat_00002.1.el6ea

redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea

redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea

redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea

redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea

and 74 more

● CVE-2020-8908

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.

redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea

redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea

redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea

redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea

and 69 more

● CVE-2020-25633

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplication...

redhat/resteasy<4.5.9.

redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea

redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea

and 56 more

● CVE-2020-13692

PostgreSQL JDBC Driver could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted ...

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

Postgresql Postgresql Jdbc Driver<42.2.13

Quarkus Quarkus<=1.5.2

Netapp Steelstore Cloud Integrated Storage

Fedoraproject Fedora=32

and 8 more

● CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attacke...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 394 more

● CVE-2020-25649

A flaw was found in FasterXML Jackson Databind which did not have entity expansion secured properly making it vulnerable to XML external entity (XXE). This vulnerability is similar to <a href="https:...

redhat/eap7-jackson-databind<0:2.10.4-1.redhat_00002.1.el6ea

redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea

redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea

redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea

redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea

and 147 more

● CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Snakeyaml Project Snakeyaml<1.26

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Quarkus Quarkus<=1.3.4

Oracle Peoplesoft Enterprise Pt Peopletools=8.56

Oracle Peoplesoft Enterprise Pt Peopletools=8.57

and 1 more

● CVE-2020-1728

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does no...

Redhat Keycloak<10.0.0

Quarkus Quarkus<=1.4.2

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el6

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el8

● CVE-2020-1714

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Obj...

maven/org.keycloak:keycloak-common<11.0.0

maven/org.keycloak:keycloak-core<11.0.0

Redhat Keycloak<11.0.0

Redhat Decision Manager=7.0

Redhat Jboss Fuse=7.0.0

Redhat Openshift Application Runtimes

and 3 more

● CVE-2019-14900

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is use...

redhat/Hibernate ORM<5.3.18

redhat/Hibernate ORM<5.4.18

redhat/Hibernate ORM<5.5.0.

redhat/Hibernate ORM 5.3.17.Final-redhat<00001

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

and 125 more

Latest Quarkus Vulnerabilities

Company

Resources

Contact