io.quarkus:quarkus-resteasy-reactive-servlet (1.11.3.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.3.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.3.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.3.final -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.13.4.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.13.4.final) +2 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.4.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.13.4.final -...

io.quarkus:quarkus-azure-functions-http (0.23.0), io.quarkus:quarkus-azure-functions-http-deployment (0.23.0) +38 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-vertx-http (0.23.0)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.0 - io.quarkus:quarkus-azure-functions-http-deployment...

com.github.mcollovati:quarkus-hilla (>=2.0.0-beta1, <=2.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0, <=2.0.1) +8 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (>=3.3.0, <=3.3.2)

io.quarkus:quarkus-undertow MAVEN version =3.3.0, =2.0.0-beta1, =2.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.2 Source cves: CVE-2023-4853 Source advisory: OSV:GHSA-4F4R-WGV2-JJVG...

io.quarkus:quarkus-elytron-security-deployment (0.13.3), io.quarkus:quarkus-resteasy (0.13.3) +21 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.13.3)

io.quarkus:quarkus-undertow MAVEN version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-elytron-security-deployment 0.13.3 - io.quarkus:quarkus-resteasy 0.13.3 -...

io.quarkus:quarkus-amazon-lambda (0.13.0), io.quarkus:quarkus-amazon-lambda-deployment (0.13.0) +23 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.13.0)

io.quarkus:quarkus-undertow MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-amazon-lambda 0.13.0 - io.quarkus:quarkus-amazon-lambda-deployment 0.13.0 -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.0.cr1), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.0.cr1) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.0.cr1)

io.quarkus:quarkus-undertow MAVEN version 1.11.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.0.cr1 -...

io.quarkus:quarkus-resteasy-reactive-servlet (1.11.7.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.11.7.final) +3 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.11.7.final)

io.quarkus:quarkus-undertow MAVEN version 1.11.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.11.7.final -...

io.quarkiverse.cxf:quarkus-cxf (0.6), io.quarkiverse.cxf:quarkus-cxf-deployment (0.6) +5 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.2.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 0.6 - io.quarkiverse.cxf:quarkus-cxf-deployment 0.6 -...

io.quarkus:quarkus-amazon-lambda (0.11.0), io.quarkus:quarkus-elytron-security (0.11.0) +10 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.11.0)

io.quarkus:quarkus-undertow MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-amazon-lambda 0.11.0 - io.quarkus:quarkus-elytron-security 0.11.0 -...

com.github.adminfaces:quarkus-omnifaces (1.2.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.2.0) +15 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.12.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.12.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.2.0 - com.github.adminfaces:quarkus-omnifaces-deployment...

io.quarkus:quarkus-resteasy-reactive-servlet (1.13.3.final), io.quarkus:quarkus-resteasy-reactive-servlet-deployment (1.13.3.final) +80 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.13.3.final)

io.quarkus:quarkus-undertow MAVEN version 1.13.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-resteasy-reactive-servlet 1.13.3.final -...

com.github.mcollovati:quarkus-hilla (>=2.0.0-beta1, <=2.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0, <=2.0.1) +8 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (>=3.3.0, <=3.3.2)

io.quarkus:quarkus-undertow MAVEN version =3.3.0, =2.0.0-beta1, =2.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.2 Source cves: CVE-2023-4853 Source advisory: MEND:CVE-2023-4853...

RESTEasy: creation of insecure temp files

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update

Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.4 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which provides a detailed severity rating, is available for each vulnerability from th...

Security Bulletin: RESTEasy component is vulnerable to CVE-2023-0482 is used by IBM Maximo Application Suite

Summary IBM Maximo Application Suite uses RESTEasypackage which is vulnerable to CVE-2023-0482. Vulnerability Details CVEID:CVE-2023-0482 DESCRIPTION: RESTEasy could allow a local authenticated attacker to gain elevated privileges on the system, caused by the creation of insecure temp files in th...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482)

Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Refer to t...

Security Bulletin: There are several vulnerabilities in Liberty used by the IBM Maximo Manage application in the IBM Maximo Application Suite

Summary There are several vulnerabilities in Liberty used by the IBM Maximo Manage application in the IBM Maximo Application Suite. These vulnerabiblities have been addressed. Vulnerability Details CVEID:CVE-2023-0482 DESCRIPTION: RESTEasy could allow a local authenticated attacker to gain elevat...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to RESTEasy privileges elevation vulnerability( CVE-2023-0482)

Summary Potential RESTEasy privileges elevation vulnerability CVE-2023-0482 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-0482 DESCRIPTION: RESTEasy could allow a local...