Red Hat Security Advisory

RHSA-2024:1662

Red Hat build of Quarkus 3.2.11 release and security update

Released 2024-04-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2

Fixes 7 records

TI-2024-01491 CVE-2024-1597 · GHSA-24rp-q3w6-vc56

pgjdbc SQL Injection via line comment generation

HIGH 82

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0481 Published 2024-02-19 Partial fix · 42.7.2, 42.6.1 +4 CWE-89

TI-2024-00946 CVE-2024-1023 · GHSA-5667-3wch-7q7w

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

MEDIUM 62

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01653 Published 2024-03-27 Partial fix · 2.4.0-7, 2.4.0-4 +5 CWE-401

TI-2024-16916 CVE-2024-25710 · GHSA-4g9r-vxhx-9pgx

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

LOW 36

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

CVSS 3.1HIGH 8.1 Local No auth No interaction EPSS 0.00441 Published 2024-02-19 Partial fix · 1.26.0 CWE-835

TI-2024-01605 CVE-2024-1726 · GHSA-mv64-86g8-cqq7

Quarkus: security checks for some inherited endpoints performed after serialization in…

LOW 31

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00727 Published 2024-04-25 Partial fix · 3.2.11.Final, 3.7.4 +2 CWE-281

TI-2024-17389 CVE-2024-26308 · GHSA-4265-ccf5-phj5

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

LOW 27

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00898 Published 2024-02-19 Partial fix · 1.26.0 CWE-770

TI-2024-01210 CVE-2024-1300 · GHSA-9ph3-v2vh-3qx7

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

LOW 27

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01064 Published 2024-04-02 Partial fix · 2.4.0-7, 2.4.0-4 +9 CWE-772

TI-2024-01842 CVE-2024-1979 · GHSA-7g97-7r3c-5cc6

Quarkus: information leak in annotation

LOW 18

A vulnerability was found in Quarkus.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.006 Published 2024-03-13 Partial fix · 3.2.11, 3.2.11.Final-redhat-00001 +1 CWE-200