RHSA-2022:9023HighCVSS 9.8

Red Hat Security Advisory: Red Hat build of Quarkus 2.13.5 release and security update

Published
December 14, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2022-31197 →CVE-2022-37734 →CVE-2022-42003 →CVE-2022-42004 →CVE-2022-42889 →CVE-2022-3171 →CVE-2022-4116 →CVE-2022-4147 →

📋 Description

CVE-2022-3171 — protobuf-java: timeout in parser leads to DoS CVE-2022-4116 — quarkus_dev_ui: Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE CVE-2022-4147 — quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus CVE-2022-31197 — postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names CVE-2022-37734 — graphql-java: DoS by malicious query CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2022-42889 — apache-commons-text: variable interpolation RCE

🎯 Affected products1

  • Red Hat build of Quarkus 2.13.5

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

🔗 References (13)