Red Hat Build Of Quarkus vulnerabilities

21 CVEs affecting Red Hat Build Of Quarkus, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6394, published 2023-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-4116, published 2022-11-22. Critical severity, CVSS 9.8. EPSS: 32.5% chance of exploitation in the next 30 days. A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
CVE-2019-14900, published 2020-07-06. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is…
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2021-20218, published 2021-03-16. High severity, CVSS 7.4. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to…
CVE-2022-1259, published 2022-08-31. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an…
CVE-2022-1011, published 2022-03-18. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem,…
CVE-2023-2974, published 2023-07-04. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the…
CVE-2021-3642, published 2021-08-05. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest…

Latest

CVE-2023-6394, published 2023-12-09. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without…
CVE-2023-6393, published 2023-12-06. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to…
CVE-2023-1664, published 2023-05-26. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak.…
CVE-2023-0044, published 2023-02-23. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented…
CVE-2022-4492, published 2023-02-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and…