Read the docs
Red Hat Security Advisory

RHSA-2023:0758

Red Hat build of Quarkus 2.13.7 release and security update

Released 2023-02-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-01345 CVE-2022-1471 · GHSA-mjmj-j48q-9wg2

Remote Code execution in SnakeYAML

Priority CRITICAL 88

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99501 Published 2022-12-01 Partial fix · 2.0 CWE-20
TI-2022-22144 CVE-2022-45047 · GHSA-fhw8-8j55-vwgq

Apache MINA SSHD: Java unsafe deserialization vulnerability

Priority HIGH 82

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0381 Published 2022-11-16 Partial fix · 2.9.2 CWE-502
TI-2022-20222 CVE-2022-41881 · GHSA-fx2c-96vj-985v

Uncontrolled recursion in netty

Priority HIGH 72

Netty project is an event-driven asynchronous network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01577 Published 2022-12-12 Partial fix · 4.1.86.Final CWE-674
TI-2023-00041 CVE-2023-0044 · GHSA-c57v-hc7m-8px2

Cross-site scripting in quarkus-vertx-http

Priority LOW 28

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0055 Published 2023-02-23 Fixed in 2.13.7.Final CWE-79