Red Hat Security Advisory

RHSA-2022:8957

Red Hat build of Quarkus Platform 2.7.6.SP3 and security update

Released 2022-12-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus Platform 2.7.6.SP3

Fixes 3 records

TI-2022-22144 CVE-2022-45047 · GHSA-fhw8-8j55-vwgq

Apache MINA SSHD: Java unsafe deserialization vulnerability

HIGH 82

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0381 Published 2022-11-16 Partial fix · 2.9.2 CWE-502

TI-2022-03763 CVE-2022-4116 · GHSA-g56w-cwg4-hxx9

Injection in quarkus

HIGH 67

A vulnerability was found in quarkus.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.32516 Published 2022-11-22 Fixed in 2.14.2.Final, 2.13.5.Final CWE-74

TI-2022-03793 CVE-2022-4147 · GHSA-9895-g6x5-xwcp

Improper authorization in quarkus-2

LOW 34

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00616 Published 2022-12-06 Fixed in 2.14.2.Final, 2.13.5.Final CWE-1026