Read the docs
Red Hat Security Advisory

RHSA-2022:0589

Red Hat build of Quarkus 2.2.5 release and security update

Released 2022-02-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 8 records

TI-2021-18101 CVE-2021-41269 · GHSA-p9m8-27x8-rg87

Unauthenticated remote code injection in cron-utils

Priority MEDIUM 50

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.04349 Published 2021-11-15 Partial fix · 9.1.6 CWE-94
TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-02132 CVE-2021-2471 · GHSA-w6f2-8wx4-47r5

Incorrect authorization in Oracle MySQL Connectors

Priority LOW 37

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.07493 Published 2021-10-20 Partial fix · 8.0.27 CWE-863
TI-2021-15833 CVE-2021-38153 · GHSA-3j6g-hxx5-3q26

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Priority LOW 36

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.06201 Published 2021-09-22 Partial fix · 2.6.3, 2.7.2 +1 CWE-203
TI-2021-03045 CVE-2021-4178 · GHSA-98g7-rxmf-rrxm

Deserialization of untrusted data in kubernetes-client

Priority LOW 30

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00335 Published 2022-08-24 Partial fix · 5.0.3, 5.1.2 +5 CWE-502