The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4326.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat build of Quarkus 3.8.5 release and security update Advisory ID: RHSA-2024:4326-03 Product: Red Hat build of Quarkus Advisory URL: https://access.redhat.com/errata/RHSA-2024:4326 Issue date: 2024-07-14 Revision: 03 CVE Names: CVE-2024-29857 ==================================================================== Summary: An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. Description: This release of Red Hat build of Quarkus 3.8.5 includes security updates, bug fixes and enhancements. For more information, see the release notes page listed in the References section. Security Fix(es): * (CVE-2024-29857) org.bouncycastle:bcprov-jdk18on: org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service [quarkus-3.8] * (CVE-2024-30172) org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class [quarkus-3.8] * (CVE-2024-34447) org.bouncycastle/bcprov-jdk18on: org.bouncycastle: Use of Incorrectly-Resolved Name or Reference [quarkus-3.8] * (CVE-2024-30171) org.bouncycastle-bcprov-jdk18on: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack) [quarkus-3.8] Solution: CVEs: CVE-2024-29857 References: https://access.redhat.com/security/updates/classification/#moderate https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.8 https://access.redhat.com/articles/4966181 https://bugzilla.redhat.com/show_bug.cgi?id=2276360 https://bugzilla.redhat.com/show_bug.cgi?id=2279227 https://bugzilla.redhat.com/show_bug.cgi?id=2293025 https://bugzilla.redhat.com/show_bug.cgi?id=2293028 https://issues.redhat.com/browse/QUARKUS-3540 https://issues.redhat.com/browse/QUARKUS-3660 https://issues.redhat.com/browse/QUARKUS-4184 https://issues.redhat.com/browse/QUARKUS-4318 https://issues.redhat.com/browse/QUARKUS-4402 https://issues.redhat.com/browse/QUARKUS-4430 https://issues.redhat.com/browse/QUARKUS-4431 https://issues.redhat.com/browse/QUARKUS-4486 https://issues.redhat.com/browse/QUARKUS-4488 https://issues.redhat.com/browse/QUARKUS-4489 https://issues.redhat.com/browse/QUARKUS-4490 https://issues.redhat.com/browse/QUARKUS-4491 https://issues.redhat.com/browse/QUARKUS-4492 https://issues.redhat.com/browse/QUARKUS-4493 https://issues.redhat.com/browse/QUARKUS-4494 https://issues.redhat.com/browse/QUARKUS-4495 https://issues.redhat.com/browse/QUARKUS-4497 https://issues.redhat.com/browse/QUARKUS-4498 https://issues.redhat.com/browse/QUARKUS-4499 https://issues.redhat.com/browse/QUARKUS-4500 https://issues.redhat.com/browse/QUARKUS-4501 https://issues.redhat.com/browse/QUARKUS-4502 https://issues.redhat.com/browse/QUARKUS-4503 https://issues.redhat.com/browse/QUARKUS-4504 https://issues.redhat.com/browse/QUARKUS-4505 https://issues.redhat.com/browse/QUARKUS-4506 https://issues.redhat.com/browse/QUARKUS-4507 https://issues.redhat.com/browse/QUARKUS-4508 https://issues.redhat.com/browse/QUARKUS-4509 https://issues.redhat.com/browse/QUARKUS-4510 https://issues.redhat.com/browse/QUARKUS-4511 https://issues.redhat.com/browse/QUARKUS-4512 https://issues.redhat.com/browse/QUARKUS-4514 https://issues.redhat.com/browse/QUARKUS-4515 https://issues.redhat.com/browse/QUARKUS-4516 https://issues.redhat.com/browse/QUARKUS-4517 https://issues.redhat.com/browse/QUARKUS-4518 https://issues.redhat.com/browse/QUARKUS-4519 https://issues.redhat.com/browse/QUARKUS-4520 https://issues.redhat.com/browse/QUARKUS-4522 https://issues.redhat.com/browse/QUARKUS-4523 https://issues.redhat.com/browse/QUARKUS-4525 https://issues.redhat.com/browse/QUARKUS-4526 https://issues.redhat.com/browse/QUARKUS-4527 https://issues.redhat.com/browse/QUARKUS-4529 https://issues.redhat.com/browse/QUARKUS-4530 https://issues.redhat.com/browse/QUARKUS-4531 https://issues.redhat.com/browse/QUARKUS-4532 https://issues.redhat.com/browse/QUARKUS-4533 https://issues.redhat.com/browse/QUARKUS-4534 https://issues.redhat.com/browse/QUARKUS-4535 https://issues.redhat.com/browse/QUARKUS-4536 https://issues.redhat.com/browse/QUARKUS-4537 https://issues.redhat.com/browse/QUARKUS-4538 https://issues.redhat.com/browse/QUARKUS-4539 https://issues.redhat.com/browse/QUARKUS-4540 https://issues.redhat.com/browse/QUARKUS-4541 https://issues.redhat.com/browse/QUARKUS-4542 https://issues.redhat.com/browse/QUARKUS-4543 https://issues.redhat.com/browse/QUARKUS-4544 https://issues.redhat.com/browse/QUARKUS-4545 https://issues.redhat.com/browse/QUARKUS-4547 https://issues.redhat.com/browse/QUARKUS-4548 https://issues.redhat.com/browse/QUARKUS-4549 https://issues.redhat.com/browse/QUARKUS-4550 https://issues.redhat.com/browse/QUARKUS-4551 https://issues.redhat.com/browse/QUARKUS-4552 https://issues.redhat.com/browse/QUARKUS-4553 https://issues.redhat.com/browse/QUARKUS-4608