RHSA-2023:7612HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Quarkus 3.2.9 release and security update

Published
November 30, 2023
Last Modified
September 14, 2026

🔗 CVE IDs covered (3)

CVE-2023-6394 →CVE-2023-39410 →CVE-2023-43642 →

📋 Description

CVE-2023-6394 — quarkus: GraphQL operations over WebSockets bypass CVE-2023-39410 — apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2023-43642 — snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact

🎯 Affected products200

  • Red Hat build of Quarkus 3.2.9.Final
  • aopalliance.aopalliance-1.0.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.aayushatharva.brotli4j.brotli4j-1.12.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.12.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.aayushatharva.brotli4j.service-1.12.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.apollographql.federation.federation-graphql-java-support-2.1.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.apollographql.federation.federation-graphql-java-support-api-2.1.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.cronutils.cron-utils-9.2.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.dajudge.kindcontainer.kindcontainer-1.3.0.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.classmate-1.5.1.redhat-00003.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.core.jackson-annotations-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.core.jackson-core-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.core.jackson-databind-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.dataformat.jackson-dataformat-properties-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.dataformat.jackson-dataformat-yaml-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.datatype.jackson-datatype-jdk8-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.datatype.jackson-datatype-jsr310-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-base-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-json-provider-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.module.jackson-module-jakarta-xmlbind-annotations-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.fasterxml.jackson.module.jackson-module-parameter-names-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.ben-manes.caffeine.caffeine-3.1.5.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.docker-java.docker-java-api-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.docker-java.docker-java-transport-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.docker-java.docker-java-transport-zerodep-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.java-json-tools.btf-1.3.0.redhat-00003.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.java-json-tools.jackson-coreutils-2.0.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.java-json-tools.json-patch-1.13.0.redhat-00007.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • com.github.java-json-tools.msg-simple-1.2.0.redhat-00002.jar as a component of Red Hat build of Quarkus 3.2.9.Final
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

🔗 References (113)