PT-2024-5140

Name of the Vulnerable Software and Affected Versions: Quarkus affected versions not specified Description: The issue is related to a flaw in the RESTEasy Reactive implementation, where security checks for some JAX-RS endpoints are performed after serialization, leading to increased resource...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.6.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.6.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.6.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.4.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.4.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.4.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.0), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.0) +181 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (>=3.0.0.final, <=3.2.8.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version =3.0.0.final, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.7 and more Source cves: CVE-2023-6267 Source advisory: GHSA-8J3X-W35R-RW4R...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.7.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.7.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.7.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.0.cr1), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.13.0.cr1) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.0.cr1)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.1.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.13.1.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.1.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.5.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.5.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.5.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.0.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.13.0.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.0.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.2.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.13.2.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.2.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

com.ibm.research.kar:kar-runtime-quarkus (1.0.9), io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.3.final) +11 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.3.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - com.ibm.research.kar:kar-runtime-quarkus 1.0.9 -...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +190 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (>=2.0.0.alpha1, <=2.13.8.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version =2.0.0.alpha1, =1.0.2, =1.0.2, =1.0.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42, =1.0.42, =1.0.42, =1.0.22, =1.0.22, =1.0.22, =1.0.15, =1.0.17 and more Source cves: CVE-2023-6267 Source advisory: OSV:GHSA-8J3X-W35R-RW4R...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.0), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.0) +181 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (>=3.0.0.final, <=3.2.8.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version =3.0.0.final, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.7 and more Source cves: CVE-2023-6267 Source advisory: OSV:GHSA-8J3X-W35R-RW4R...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.0.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.0.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.0.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.11.0.beta2), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.11.0.beta2) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.11.0.beta2)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.11.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

io.quarkus.resteasy.reactive:resteasy-reactive-processor (1.13.6.final), io.quarkus.resteasy.reactive:resteasy-reactive-vertx (1.13.6.final) +10 more potentially affected by CVE-2023-6267 via io.quarkus.resteasy.reactive:resteasy-reactive (1.13.6.final)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-processor...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 2.13.9.SP1 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.3.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.3.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.3.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.3.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.0.beta2), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.0.beta2) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.0.beta2)

io.quarkus:quarkus-undertow MAVEN version 1.11.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.0.beta2 -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.0.beta1), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.0.beta1) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.0.beta1)

io.quarkus:quarkus-undertow MAVEN version 1.11.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.0.beta1 -...