io.quarkus:quarkus-resteasy-reactive-servlet (1.11.3.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.3.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.3.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.3.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.13.1.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.13.1.final) +2 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.1.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.13.1.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.7.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.7.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.7.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.7.final -...

com.github.mcollovati:quarkus-hilla (>=2.0.0-beta1, <=2.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0, <=2.0.1) +8 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (>=3.3.0, <=3.3.2)

io.quarkus:quarkus-undertow MAVEN version =3.3.0, =2.0.0-beta1, =2.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.2 Source cves: CVE-2023-4853 Source advisory: OSV:GHSA-4F4R-WGV2-JJVG...

com.github.adminfaces:quarkus-omnifaces (1.2.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.2.0) +15 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.12.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.12.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.2.0 - com.github.adminfaces:quarkus-omnifaces-deployment...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.6.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.6.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.6.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.6.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.13.7.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.13.7.final) +2 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.7.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.13.7.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.13.6.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.13.6.final) +2 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.6.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.13.6.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.12.2.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.12.2.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.12.2.final)

io.quarkus:quarkus-undertow MAVEN version 1.12.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.12.2.final -...

com.github.mcollovati:quarkus-hilla (>=2.0.0-beta1, <=2.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0, <=2.0.1) +8 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (>=3.3.0, <=3.3.2)

io.quarkus:quarkus-undertow MAVEN version =3.3.0, =2.0.0-beta1, =2.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.2 Source cves: CVE-2023-4853 Source advisory: MEND:CVE-2023-4853...

Information Disclosure

resteasy-reactive-common is vulnerable to Information Disclosure. The vulnerability exists because the readFrom function in FileBodyHandler.java creates a temporary file with insecure permissions, which allows a local user to read the temporary file created...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

PT-2023-16294

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description The issue arises from the use of the insecure File.createTempFile in the FileBodyHandler class within the RestEasy Reactive implementation of Quarkus. This results in the creation of temporar...

CVE-2023-0481: Creation of Temporary File With Insecure Permissions

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.7 security update

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...