RHSA-2023:7700HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Quarkus 2.13.9 release and security update

Published
December 7, 2023
Last Modified
November 6, 2026

🔗 CVE IDs covered (11)

CVE-2023-34454 →CVE-2023-34455 →CVE-2023-34462 →CVE-2023-39410 →CVE-2023-6393 →CVE-2023-6394 →CVE-2023-31582 →CVE-2023-34453 →CVE-2023-35887 →CVE-2023-43642 →CVE-2023-2976 →

📋 Description

CVE-2023-2976 — guava: insecure temporary directory creation CVE-2023-6393 — quarkus: Potential invalid reuse of context when @CacheResult on a Uni is used CVE-2023-6394 — quarkus: GraphQL operations over WebSockets bypass CVE-2023-31582 — jose4j: Insecure iteration count setting CVE-2023-34453 — snappy-java: Integer overflow in shuffle leads to DoS CVE-2023-34454 — snappy-java: Integer overflow in compress leads to DoS CVE-2023-34455 — snappy-java: Unchecked chunk length leads to DoS CVE-2023-34462 — netty: SniHandler 16MB allocation leads to OOM CVE-2023-35887 — apache-mina-sshd: information exposure in SFTP server implementations CVE-2023-39410 — apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2023-43642 — snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact

🎯 Affected products1

  • Red Hat build of Quarkus 2.13.9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder. Workaround: No mitigation is currently available for this flaw. Workaround: Configuration of SniHandler with an idle timeout will mitigate this issue.

🔗 References (19)