RHSA-2021:3880: Moderate: Red Hat build of Quarkus 2.2.3 release and security update
This release of Red Hat build of Quarkus 2.2.3 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section.Security Fix(es): maven: Block repositories using http by default (CVE-2021-26291) jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception (CVE-2020-28491) wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642) netty: Information disclosure via the local system temporary directory (CVE-2021-21290) netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295) netty: Request smuggling via content-length header (CVE-2021-21409) resteasy: Error message exposes endpoint class information (CVE-2021-20289) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:3880?
The severity of RHSA-2021:3880 is classified as important due to the associated security vulnerabilities.
How do I fix RHSA-2021:3880?
To fix RHSA-2021:3880, update to the latest version of the Red Hat build of Quarkus as specified in the advisory.
What vulnerabilities are addressed in RHSA-2021:3880?
RHSA-2021:3880 addresses the CVE-2021-26291 vulnerability related to blocking HTTP repositories by default.
What software is affected by RHSA-2021:3880?
The affected software includes the Red Hat build of Quarkus version 2.2.3 and its earlier versions.
Is there a workaround for RHSA-2021:3880?
A specific workaround for RHSA-2021:3880 is not recommended; updating to the patched version is the best approach.