Skip to content
OpenAdvisories
Medium WID-SEC-2023-3195 2 CVEs

Red Hat Quarkus: Mehrere Schwachstellen ermöglichen Denial of Service

Published Dec 20, 2023 · Updated Sep 10, 2024 · Revision 3 · de-DE

Vendor: Atlassian Vendor: Red Hat Product: Confluence Product: Enterprise Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Quarkus ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 2

  • High 7.5
    CVE-2023-39410

    Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

    When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11…

    Apache Software Foundation Apache Avro Java SDK druid tez Wolfi Maven PyPI
  • High 7.5
    CVE-2023-43642

    Missing upper bound check on chunk length in snappy-java

    snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bou…

    xerial snappy-java druid snappy-java Debian Ubuntu Wolfi Maven

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates aufgenommen

  3. #1

    Initiale Fassung

References