Red Hat Security Advisory

RHSA-2024:7670

Red Hat build of Quarkus 3.8.6.SP1 Security Update

Released 2024-10-10 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat build of Quarkus Native builder

Fixes 4 records

TI-2024-06719 CVE-2024-7254 · GHSA-735f-pc8j-v9w8

Stack overflow in Protocol Buffers Java Lite

MEDIUM 49

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02772 Published 2024-09-19 Partial fix · 28.2, 3.25.5 +2 CWE-400

TI-2024-31848 CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

MEDIUM 47

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.03256 Published 2024-10-03 Partial fix · 1.11.4 CWE-502

TI-2021-20145 CVE-2021-44549 · GHSA-c69w-jj56-834w

SMTPS server hostname not checked when making TLS connection to SMTPS server

LOW 37

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02081 Published 2021-12-14 Partial fix · 2.0 CWE-295

TI-2024-26868 CVE-2024-40094 · GHSA-h9mq-f6q5-6c8m

GraphQL Java (aka graphql-java) before 21.5 does not properly consider…

LOW 26

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00951 Published 2024-07-30 Partial fix · 19.11, 20.9 +1 CWE-770