Red Hat Security Advisory

RHSA-2023:7612

Red Hat build of Quarkus 3.2.9 release and security update

Released 2023-11-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.2.9.Final io.quarkus.quarkus-smallrye-graphql-3.2.9.Final-redhat-00002.jar, org.apache.avro.avro-1.11.3.redhat-00002.jar, org.xerial.snappy.snappy-java-1.1.10.5-redhat-00001.jar

Fixes 3 records

TI-2023-23368 CVE-2023-43642 · GHSA-55g7-9cwv-5qfv

Missing upper bound check on chunk length in snappy-java

HIGH 72

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2023-09-25 Partial fix · 1.1.10.4 CWE-770

TI-2023-20549 CVE-2023-39410 · GHSA-rhrv-645h-fjfh

Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

MEDIUM 43

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02221 Published 2023-09-29 Partial fix · 1.11.3 CWE-502

TI-2023-05869 CVE-2023-6394 · GHSA-mvc8-6ffp-jrx5

Quarkus: graphql operations over websockets bypass

MEDIUM 43

A flaw was found in Quarkus.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00807 Published 2023-12-09 Partial fix · 3.2.9.Final-redhat-00002, 3.5.3 +1 CWE-862