RHSA-2024:0722HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Quarkus 3.2.10 release and security update

Published
February 12, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2023-4043 →

📋 Description

CVE-2023-4043 — parsson: Denial of Service due to large number parsing

🎯 Affected products200

  • Red Hat build of Quarkus 3.2.10.Final
  • aopalliance.aopalliance-1.0.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.aayushatharva.brotli4j.brotli4j-1.12.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.12.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.aayushatharva.brotli4j.service-1.12.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.apollographql.federation.federation-graphql-java-support-2.1.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.apollographql.federation.federation-graphql-java-support-api-2.1.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.cronutils.cron-utils-9.2.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.dajudge.kindcontainer.kindcontainer-1.3.0.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.classmate-1.5.1.redhat-00003.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.core.jackson-annotations-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.core.jackson-core-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.core.jackson-databind-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.dataformat.jackson-dataformat-properties-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.dataformat.jackson-dataformat-yaml-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.datatype.jackson-datatype-jdk8-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.datatype.jackson-datatype-jsr310-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-base-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-json-provider-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.module.jackson-module-jakarta-xmlbind-annotations-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.fasterxml.jackson.module.jackson-module-parameter-names-2.15.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.ben-manes.caffeine.caffeine-3.1.5.redhat-00001.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.docker-java.docker-java-api-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.docker-java.docker-java-transport-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.docker-java.docker-java-transport-zerodep-3.3.0.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.java-json-tools.btf-1.3.0.redhat-00003.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.java-json-tools.jackson-coreutils-2.0.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.java-json-tools.json-patch-1.13.0.redhat-00007.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • com.github.java-json-tools.msg-simple-1.2.0.redhat-00002.jar as a component of Red Hat build of Quarkus 3.2.10.Final
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid processing untrusted sources content in order to minimize the chance for Denial of Service attack.

🔗 References (36)