1770 matches found
CVE-2024-1726
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726
Quarkus RESTEasy Reactive contains a denial-of-service vulnerability (CVE-2024-1726) where security checks for some inherited JAX-RS endpoints are performed after serialization, causing increased resource usage when an attacker knows POST/PUT/PATCH paths. This could lead to DoS as endpoints proce...
CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2023-5675
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
br.com.labbs:quarkus-monitor-reactive (>=1.0.4, <=2.0.0), br.com.labbs:quarkus-monitor-reactive-deployment (>=1.0.4, <=2.0.0) +254 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (>=1.11.0.beta1, <=3.2.9.final)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version =1.11.0.beta1, =1.0.4, =1.0.4, =1.0.2, =1.0.2, =1.0.2, =1.3.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42, =1.0.42, =1.0.42, =1.3.2, =1.0.22, =1.0.22, =1.3.3 and more Source cves: CVE-2023-5675 Source advisory: MEND:CVE-2023-5675...
com.github.mcollovati:quarkus-hilla-commons-deployment (>=2.4.1, <=2.5.0), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0-beta1, <=2.5.0) +51 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (>=3.3.0, <=3.6.8)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version =3.3.0, =2.4.1, =2.0.0-beta1, =2.4.1, =0.32.0, =0.32.0, =preview, =0.0.0, =0.5.0, =0.2.0, =0.6.3, =0.1.0, =0.1.0, =0.1.0, =0.7.1 and more Source cves: CVE-2023-5675 Sou...
io.quarkiverse.cxf:quarkus-cxf-integration-test-hc5 (2.7.0), io.quarkiverse.renarde:quarkus-renarde (>=3.0.8, <=3.0.9) +43 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (3.7.0)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - io.quarkiverse.cxf:quarkus-cxf-integration-test-hc5 2.7.0 -...
br.com.labbs:quarkus-monitor-reactive-deployment (>=1.0.4, <=2.0.0), com.github.mcollovati:quarkus-hilla-deployment (>=1.0.0-alpha1, <=2.0.0-alpha1) +47 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (>=1.11.0.beta1, <=3.2.9.final)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version =1.11.0.beta1, =1.0.4, =1.0.0-alpha1, =0.8.0, =0.8.0, =1.0.0, =1.0.3, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.30.0, =1.1.final, =2.13.0.cr1, =3.2.9.final and more Source cves: CVE-2023-5675 Source advisor...
CVE-2023-5675
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
CVE-2023-5675 Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
cn.sliew:carp-ageiport-server (>=0.0.10, <=0.0.14), com.abavilla:fpi-bot-api (>=1.8.1, <=1.8.5) +190 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (>=3.3.0, <=3.6.8)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version =3.3.0, =0.0.10, =1.8.1, =1.8.1, =1.8.6, =1.8.6, =1.9.0, =1.9.0, =1.10.1, =1.10.1, =1.0.29, =1.0.29, =1.6.1, =1.6.1, =1.5.1, =1.5.1, =1.6.0 and more Source cves: CVE-2023-5675 Source advisory: MEND:CVE-2023-5675...
CVE-2023-5675 Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
io.quarkiverse.renarde:quarkus-renarde-backoffice-deployment (>=3.0.8, <=3.0.9), io.quarkiverse.renarde:quarkus-renarde-deployment (>=3.0.8, <=3.0.9) +15 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (3.7.0)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...
CVE-2024-1726: Improper Preservation of Permissions
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2023-5675: Improper Authorization
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
Advisory ROSA-SA-2024-2375
Software: resteasy 3.0.26 OS: ROSA Virtualization 2.1 packageevrstring: resteasy-c-3.0.26-6.0.1.rv3 CVE-ID: CVE-2020-10688 BDU-ID: 2024-01096 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the RESTEasy software tool is related to the failure to take measures to protect the structure of a web page...
RESTEasy: creation of insecure temp files
In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...
Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.5 security update
An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which provides a detailed severity rating, is available for each vulnerability from th...