Lucene search

RedHatRHSA-2024:0495

HistoryJan 25, 2024 - 1:50 p.m.

(RHSA-2024:0495) Important: Red Hat build of Quarkus 3.2.9.SP1 release and security update

2024-01-2513:50:06

access.redhat.com

red hat

quarkus 3.2.9.sp1

security update

cve-2023-5675

cve-2023-6267

authorization flaw

json payload

rest resources

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.9%

JSON

This release of Red Hat build of Quarkus 3.2.9.SP1 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section.

Security Fix(es):

CVE-2023-5675 io.quarkus.resteasy.reactive/resteasy-reactive: quarkus: Authorization flaw in Quarkus RestEasy Reactive and Classic when “quarkus.security.jaxrs.deny-unannotated-endpoints” or "quarkus.security.jaxrs.default-role [quarkus-3.2]
CVE-2023-6267 io.quarkus.resteasy.reactive/resteasy-reactive: quarkus: json payload getting processed prior to security checks when rest resources are used with annotations [quarkus-3.2]