Red Hat Security AdvisoryRHSA-2023:1006
Red Hat build of Quarkus 2.7.7 release and security update
Released 2023-03-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 2.7.7
Fixes 9 records
Priority CRITICAL 94
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99931 · Published 2022-10-13 · Partial fix · 1.10.0 CWE-94
Priority CRITICAL 88
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99501 · Published 2022-12-01 · Partial fix · 2.0 CWE-20
Priority HIGH 75
XStream serializes Java objects to XML and back again.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.09347 · Published 2022-12-27 · Partial fix · 1.4.20 CWE-120
Priority HIGH 70
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.02355 · Published 2022-08-03 · Partial fix · 42.2.26, 42.4.1 +1 CWE-89
Priority MEDIUM 45
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4 CWE-502
Priority LOW 39
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4.2 CWE-502
Priority LOW 35
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01278 · Published 2022-10-12 · Fixed in 3.21.7, 3.20.3 +2 CWE-20
Priority LOW 28
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0055 · Published 2023-02-23 · Fixed in 2.13.7.Final CWE-79
Priority LOW 26
pgjdbc is an open source postgresql JDBC Driver.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00552 · Published 2022-11-23 · Partial fix · 42.2.27, 42.4.3 +2 CWE-200
THREATIST.IORead the docs