Red Hat Security Advisory

RHSA-2022:9023

Red Hat build of Quarkus 2.13.5 release and security update

Released 2022-12-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus 2.13.5

Fixes 8 records

TI-2022-20885 CVE-2022-42889 · GHSA-599f-7c49-w659

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

CRITICAL 94

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99931 Published 2022-10-13 Partial fix · 1.10.0 CWE-94

TI-2022-13237 CVE-2022-31197 · GHSA-r38f-c4h4-hqq2

SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

HIGH 70

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.02355 Published 2022-08-03 Partial fix · 42.2.26, 42.4.1 +1 CWE-89

TI-2022-03763 CVE-2022-4116 · GHSA-g56w-cwg4-hxx9

Injection in quarkus

HIGH 67

A vulnerability was found in quarkus.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.32516 Published 2022-11-22 Fixed in 2.14.2.Final, 2.13.5.Final CWE-74

TI-2022-20343 CVE-2022-42004 · GHSA-rgv9-q543-rqg4

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a…

MEDIUM 45

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4 CWE-502

TI-2022-20342 CVE-2022-42003 · GHSA-jjjh-jjxp-wpff

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion…

LOW 39

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4.2 CWE-502

TI-2022-17545 CVE-2022-37734 · GHSA-v62j-cxhh-fq22

graphql-java before19.0 is vulnerable to Denial of Service.

LOW 38

graphql-java before19.0 is vulnerable to Denial of Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02795 Published 2022-09-12 Partial fix · 17.4, 18.3 CWE-400

TI-2022-02927 CVE-2022-3171 · GHSA-h4h5-3hr4-j3g2

Memory handling vulnerability in ProtocolBuffers Java core and lite

LOW 35

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01278 Published 2022-10-12 Fixed in 3.21.7, 3.20.3 +2 CWE-20

TI-2022-03793 CVE-2022-4147 · GHSA-9895-g6x5-xwcp

Improper authorization in quarkus-2

LOW 34

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00616 Published 2022-12-06 Fixed in 2.14.2.Final, 2.13.5.Final CWE-1026