Red Hat Security Advisory

RHSA-2021:3880

Red Hat build of Quarkus 2.2.3 release and security update

Released 2021-10-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Quarkus 2.2.3

Fixes 7 records

TI-2021-08126 CVE-2021-26291 · GHSA-2f88-5hg8-9x2x

block repositories using http by default

MEDIUM 51

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.08691 Published 2021-04-23 Partial fix · 3.8.1 CWE-346

TI-2021-04395 CVE-2021-21295 · GHSA-wm47-8v5p-wjpj

Possible request smuggling in HTTP/2 due missing validation

MEDIUM 50

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.18891 Published 2021-03-09 Partial fix · 4.1.60.Final CWE-444

TI-2021-04507 CVE-2021-21409 · GHSA-f256-j965-7f32

Possible request smuggling in HTTP/2 due missing validation of content-length

MEDIUM 40

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.04935 Published 2021-03-30 Partial fix · 4.1.61.Final CWE-444

TI-2020-17296 CVE-2020-28491 · GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

LOW 37

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02417 Published 2021-02-18 Partial fix · 2.11.4, 2.12.1 CWE-770

TI-2021-04390 CVE-2021-21290 · GHSA-5mcr-gq6c-3hq2

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

LOW 31

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.01799 Published 2021-02-08 Partial fix · 4.1.59.Final CWE-378

TI-2021-03579 CVE-2021-20289 · GHSA-244r-fcj3-ghjq

Information disclosure through error messages in resteasy

LOW 27

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.014 Published 2021-03-26 Partial fix · 4.6.1, 4.5.10 +1 CWE-209

TI-2021-02587 CVE-2021-3642 · GHSA-5499-qjvh-6j7w

Observable discrepancy in wildfly-elytron

LOW 26

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00846 Published 2021-08-05 Partial fix · 1.10.14, 1.15.5 +1 CWE-203