Lucene search

K
redhatRedHatRHSA-2024:4079
HistoryJun 25, 2024 - 6:22 a.m.

(RHSA-2024:4079) Low: [23.1] Security update for the 23.1 release (RPMs)

2024-06-2506:22:01
access.redhat.com
6
security update
quarkus-mandrel-java
quarkus-mandrel-231
graalvm installation
openjdk 21.0.3
cve-2024-20954
cve-2024-21098

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

7

Confidence

Low

The quarkus-mandrel-java and quarkus-mandrel-231 packages provide the
GraalVM installation for the quarkus/mandrel-for-jdk-21-rhel8:23.1 container image on top of the latest release of OpenJDK 21.0.3.

Security Fix(es):

  • org.graalvm.compiler/compiler: graalvm: Unauthorized Read Access
    (CVE-2024-20954)

  • org.graalvm.compiler/compiler: graalvm: unauthorized ability to cause a partial denial of service
    (CVE-2024-21098)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

7

Confidence

Low