RHSA-2021:3880MediumCVSS 7.5

Red Hat Security Advisory: Red Hat build of Quarkus 2.2.3 release and security update

Published
October 20, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2021-3642 →CVE-2021-20289 →CVE-2021-21290 →CVE-2021-21295 →CVE-2021-21409 →CVE-2021-26291 →CVE-2020-28491 →

📋 Description

CVE-2020-28491 — jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception CVE-2021-3642 — wildfly-elytron: possible timing attack in ScramServer CVE-2021-20289 — resteasy: Error message exposes endpoint class information CVE-2021-21290 — netty: Information disclosure via the local system temporary directory CVE-2021-21295 — netty: possible request smuggling in HTTP/2 due missing validation CVE-2021-21409 — netty: Request smuggling via content-length header CVE-2021-26291 — maven: Block repositories using http by default

🎯 Affected products1

  • Red Hat build of Quarkus 2.2.3

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.

🔗 References (13)