Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.2.11 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

Incorrect Authorization

quarkus is vulnerable to Incorrect Authorization. The vulnerability is due to improper sanitization or validation for certain character permutations when accepting requests. This potentially can leads to improper evaluation of permissions, resulting in security bypass or Denial of Service...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=1.3.0 <=1.6.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=1.3.0 <=1.6.0) +2339 more potentially affected by CVE-2024-1023 via io.vertx:vertx-core (>=4.4.5 <=4.4.6)

io.vertx:vertx-core MAVEN version =4.4.5, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =23.3.4, =23.3.4, =23.3.4, =23.3.4, =23.3.4, =23.9.0, =23.3.4, =23.3.4, =23.3.4, =23.9.1 and more Source cves: CVE-2024-1023 Source advisory: OSV:GHSA-5667-3WCH-7Q7W...

io.github.project-openubl:quarkus-xsender-deployment (>=5.0.0 <=5.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (>=2.0.0 <=3.8.0) +29 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=4.0.0 <=4.0.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =4.0.0, =5.0.0, =2.0.0, =2.7.0, =2.0.0, =2.2.0, =2.2.1, =2.0.0, =2.0.0, =2.0.0, =3.0.0-M2, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.11 and more Source cves: CVE-2024-28752 Source advisory: OSV:G...

Sensitive Information Disclosure

io.quarkus, quarkus-kubernetes-deployment is vulnerable to Git Credentials Disclosure. The vulnerability due to a flaw in the continuous integration CI configuration, leading to the inadvertent publication of git credentials to the metadata annotation...

io.automatiko.quarkus:automatiko-operator-deployment (>=0.4.0 <=0.54.0), io.javaoperatorsdk:operator-framework-quarkus-extension-deployment (>=1.6.2 <=1.7.5) +18 more potentially affected by CVE-2024-1979 via io.quarkus:quarkus-kubernetes-deployment (>=1.10.0.CR1 <=3.7.2)

io.quarkus:quarkus-kubernetes-deployment MAVEN version =1.10.0.CR1, =0.4.0, =1.6.2, =0.0.3, =0.0.3, =1.0.1, =1.0.1, =4.0.0, =2.0.0, =1.8.0, =6.0.0, =7.2.1, =7.6.1, =7.6.1, =7.6.1, =2.0.0, =3.0.3 and more Source cves: CVE-2024...

GHSA-7G97-7R3C-5CC6 In Quarkus, git credentials could be inadvertently published

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

In Quarkus, git credentials could be inadvertently published

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

CVE-2024-1979

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

Buffer overflow

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

CVE-2024-1979 Quarkus: information leak in annotation

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

CVE-2024-1979 Quarkus: information leak in annotation

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

CVE-2024-1979 Quarkus: information leak in annotation

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk...

CVE-2024-1979

CVE-2024-1979 affects Quarkus with an information leak in the quarkus-kubernetes-deployment component related to annotation handling. The Red Hat advisory RHSA-2024:1662 lists CVE-2024-1979 as a security fix affecting the Red Hat build of Quarkus, specifically noting a security update for Quarkus...

Quarkus Information Disclosure Vulnerability

Quarkus is a cloud-native Linux container-first framework for writing Java applications. An information disclosure vulnerability exists in Quarkus that stems from the presence of an information disclosure vulnerability...

PT-2024-18467 · Quarkus · Quarkus

Name of the Vulnerable Software and Affected Versions: Quarkus affected versions not specified Description: A vulnerability was found in Quarkus where, under certain conditions related to the Continuous Integration CI process, git credentials could be inadvertently published. This could put the g...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for February 2023.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 23.0.2-IF002. Vulnerability Details CVEID:CVE-2023-6267 DESCRIPTION: Quarkus could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the json payload when...

The vulnerability of the Form Authentication component in the Quarkus Java framework allows attackers to execute XSS attacks.

The vulnerability of the Form Authentication component in the Quarkus Java framework is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker to carry out XSS attacks remotely...

CVE-2024-1979

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk. Mitigation Ensure that at least one of the preconditions is not present in your environment...

CVE-2024-1726

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...