-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2618
Red Hat build of Quarkus 1.3.4 SP1 release and security update
31 July 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat build of Quarkus 1.3.4 SP1
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14326 CVE-2020-13692
Reference: ESB-2020.2613
ESB-2020.2576
ESB-2020.2467
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:3248
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat build of Quarkus 1.3.4 SP1 release and security update
Advisory ID: RHSA-2020:3248-01
Product: Red Hat build of Quarkus
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3248
Issue date: 2020-07-30
CVE Names: CVE-2020-13692 CVE-2020-14326
=====================================================================
1. Summary:
An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each
vulnerability. For more information, see the CVE links in the References
section.
2. Description:
This release of Red Hat build of Quarkus 1.3.4 SP1 includes security
updates, bug fixes, and enhancements. For more information, see the release
notes page listed in the References section.
Security Fix(es):
* postgresql-jdbc: XML external entity (XXE) vulnerability in
PgSQLXML(CVE-2020-13692)
* RESTEasy: Caching routes in RootNode may result in DoS (CVE-2020-14326)
For more details about the security issues and their impact, the CVSS
score, acknowledgments, and other related information see the CVE pages
listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link for the
update. You must be logged in to download the update.
4. Bugs fixed (https://bugzilla.redhat.com/):
1852985 - CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
1855826 - CVE-2020-14326 RESTEasy: Caching routes in RootNode may result in DoS
5. References:
https://access.redhat.com/security/cve/CVE-2020-13692
https://access.redhat.com/security/cve/CVE-2020-14326
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=
redhat.quarkus&downloadType=distributions&version=1.3.4.SP1
https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/1.3/html/
release_notes_for_red_hat_build_of_quarkus_1.3/index
https://access.redhat.com/articles/4966181
6. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXyLNDtzjgjWX9erEAQixIg//XiHi46a5v30MSwQ1vXJVQf4AbbyS7oGO
mRt1g9owwLpk8sna9a1GWwixVpDJTv//2frvBFMosgClh7sPbiXcrASmSNg5xE5o
o3mGChv/V8Dyi1PU8b2RAgGhYho4OwNLRaFv6YXxWmJJHiKM4p37OMFXrpsVYCEA
5o1YPZfysm2Ps3FwLcAPYPMW2pb4zNIKSh2fTVXb/7URUUoz+uLRg4/ZyYUSJAgs
bsXjH7RvNjYNZzAHaE2lYpxt5buAyRhKgOZfg8/uDU6dTKHQK8lxdEAHT4kjAkEX
P3WuMIxtZpjTWbaA+OF1vdVBfcf7ZJw6OoAwufU5uGVIWwVi+HS3xhOOXw8Mwjhu
zdA5UIulFa+zCF1hHOUtmnQ2Aj+iWaI0QbfacfILutYskuqfbXAJRPXIYm6rfDfK
mYL2Jlt/mt3D01Y3LQuQKYIjUf55WReMAMJx8ljrvTvbancxMLPJ4zCdAqL/rAEA
46k96LCsDkIaeiqn+mJZpLtxfeeD6GKusEs/joNS0SMsPlANC2BlqsE3mYI1Acll
ZS+Jn5kyFoBHVphnIfBKy6ut3JddBflBEMFbP0uT/pWKNYetDpwmyAAHwgyT7Ay3
Ts9OQHVz1ugaLIu7Rv32xIiZc2JIstPBTXLaGO2FC9ur6YW8t421nlAj20E8YMHo
2VM1F+aLeOw=
=0hK2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXyOc9+NLKJtyKPYoAQhrBw/+JhSfazZzFECwv5drXpAMV5bFCPc7Dxu8
1MllgMd0cXzgRH8DjbIP3KmHwaTe23geKiDdnBSPNP60+fM/GKdfNUObyYLa59Bc
vwOSCo5FRFHTlRw4brq1/Ljmf9cD4H6h8cCXQcvdUYwz+S/r34eUv3aIZqR+c7gw
wzlYP1iCZh8eA/5FYlawqT+vsD45c3OQGeOyxPLnN0y7a5bZD+dnbmANU0mN3Btz
En56fkY/mT/4GqM2noAAkd9YjsNj0WduBYWEUEb9usY2DTADchQL6Ur3NaqsHsG/
9smL5NbrqntZx7NfUi3bceqDKgv57TpSK/xA0IO453n3hGYOHpupIzoP6p33z7Ng
sqHVPBwupTAlIeYlixDFj1zhtHrmWkRoqaEjY2tA863cg32oEXrL0HACg8HpS9uY
kVGU5PfsAJJJWaODK9uyj4g/Q0n2zoCCfuYqU8aY4gk4ZTTotXbT9s/uzKxuFVC9
Ikm0nFPsyzm/qSL1IejBZk+9BzemkwKeTTNcZ0e/72hG9Nh3/tVrjv4Vb27Vf7fO
ENbRTaFzWVcpxypmB3CUvd1qK8gh8VWq9OchepKS97rQgKfaaw26rbd5ezT7ymaK
p4XlIZu7iWn0BX6LwHvrgDhr9vzhHp/1jd2eiHHZSOaH/z16knqIqZczikOBc4OS
YSWZFI61bbg=
=goX0
-----END PGP SIGNATURE-----
https://www.malwaredevil.com/2020/07/31/esb-2020-2618-redhat-red-hat-build-of-quarkus-1-3-4-sp1-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-2618-redhat-red-hat-build-of-quarkus-1-3-4-sp1-multiple-vulnerabilities
No comments:
Post a Comment