RHSA-2022:9023: Important: Red Hat build of Quarkus 2.13.5 release and security update
This release of Red Hat build of Quarkus 2.13.5 includes security updates, bugfixes, and enhancements. For more information, see the release notes page listed in the References section.Security Fix(es): CVE-2022-4147 quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus CVE-2022-4116 quarkus_dev_ui: Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE CVE-2022-37734 graphql-java: DoS by malicious query CVE-2022-3171 protobuf-java: timeout in parser leads to DoS CVE-2022-42889 commons-text: apache-commons-text: variable interpolation RCE CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 jackson-databind: use of deeply nested arrays CVE-2022-31197 postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:9023?
The severity of RHSA-2022:9023 is categorized as high due to multiple security vulnerabilities that have been addressed.
How do I fix RHSA-2022:9023?
To fix RHSA-2022:9023, you should update your Red Hat build of Quarkus to the latest version available as mentioned in the advisory.
What vulnerabilities are addressed in RHSA-2022:9023?
RHSA-2022:9023 addresses security vulnerabilities including CVE-2022-4147 and others that impact the security of the Quarkus framework.
Which versions are affected by RHSA-2022:9023?
RHSA-2022:9023 affects specific versions of Red Hat builds of Quarkus prior to 2.13.5, which has the security updates.
Is there a rollback option for updates related to RHSA-2022:9023?
Yes, users can typically rollback updates related to RHSA-2022:9023, but it's advised to verify compatibility and test the applications before doing so.