Red Hat Security AdvisoryRHSA-2023:7653
Service Registry (container images) release and security update [2.5.4 GA]
Released 2023-12-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHINT Service Registry 2.5.4 GA
Fixes 5 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
snappy-java is a fast compressor/decompressor for Java.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01762 · Published 2023-06-15 · Partial fix · 1.1.10.1 CWE-770
Priority MEDIUM 40
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.02276 · Published 2023-09-20 · Partial fix · 1.9.2-3.el8, 2.13.8.Final-redhat-00005 +9 CWE-148
Priority LOW 35
A flaw was found in Quarkus.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00963 · Published 2023-10-04 · Fixed in 3.1.0.CR1, 2.13.8.Final-redhat-00004 +2 CWE-200
Priority LOW 34
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02459 · Published 2023-06-22 · Partial fix · 4.1.94.Final CWE-400
THREATIST.IORead the docs