Red Hat Security AdvisoryRHSA-2023:3809
Red Hat build of Quarkus 2.13.8 release and security update
Released 2023-06-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 2.13.8.Final com.graphql-java.graphql-java-19.4.0.redhat-00001.jar, io.quarkus.quarkus-grpc-2.13.8.Final-redhat-00004.jar, io.quarkus.quarkus-oidc-2.13.8.Final-redhat-00004.jar +3
Fixes 5 records
Priority MEDIUM 41
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01059 · Published 2023-03-27 · Partial fix · 0.0.0-2023-03-20T01-49-44-80e3135, 17.5 +3 CWE-770
Priority LOW 37
A vulnerability was found in quarkus-core.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00882 · Published 2023-07-04 · Partial fix · 2.13.8.Final-redhat-00004, 2.16.8.Final CWE-757
Priority LOW 35
A flaw was found in Quarkus.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00963 · Published 2023-10-04 · Fixed in 3.1.0.CR1, 2.13.8.Final-redhat-00004 +2 CWE-200
Priority LOW 25
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00279 · Published 2023-01-06 · Partial fix · 0.8.9 CWE-312
Priority LOW 15
In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.
CVSS 3.1LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00206 · Published 2023-02-24 · Fixed in 3.0.0.Alpha4 CWE-378
THREATIST.IORead the docs