Red Hat Security Advisory 2024-4326-03

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4326.json

Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat’s archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

– Packet Storm Staff

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat build of Quarkus 3.8.5 release and security update
Advisory ID: RHSA-2024:4326-03
Product: Red Hat build of Quarkus
Advisory URL: https://access.redhat.com/errata/RHSA-2024:4326
Issue date: 2024-07-14
Revision: 03
CVE Names: CVE-2024-29857
====================================================================

Summary:

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description:

This release of Red Hat build of Quarkus 3.8.5 includes security updates, bug fixes and enhancements. For more information, see the release notes page listed in the References section.

Security Fix(es):

* (CVE-2024-29857) org.bouncycastle:bcprov-jdk18on: org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service [quarkus-3.8]

* (CVE-2024-30172) org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class [quarkus-3.8]

* (CVE-2024-34447) org.bouncycastle/bcprov-jdk18on: org.bouncycastle: Use of Incorrectly-Resolved Name or Reference [quarkus-3.8]

* (CVE-2024-30171) org.bouncycastle-bcprov-jdk18on: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack) [quarkus-3.8]

Solution:

CVEs:

CVE-2024-29857

References:

https://access.redhat.com/security/updates/classification/#moderate
https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.8
https://access.redhat.com/articles/4966181
https://bugzilla.redhat.com/show_bug.cgi?id=2276360
https://bugzilla.redhat.com/show_bug.cgi?id=2279227
https://bugzilla.redhat.com/show_bug.cgi?id=2293025
https://bugzilla.redhat.com/show_bug.cgi?id=2293028
https://issues.redhat.com/browse/QUARKUS-3540
https://issues.redhat.com/browse/QUARKUS-3660
https://issues.redhat.com/browse/QUARKUS-4184
https://issues.redhat.com/browse/QUARKUS-4318
https://issues.redhat.com/browse/QUARKUS-4402
https://issues.redhat.com/browse/QUARKUS-4430
https://issues.redhat.com/browse/QUARKUS-4431
https://issues.redhat.com/browse/QUARKUS-4486
https://issues.redhat.com/browse/QUARKUS-4488
https://issues.redhat.com/browse/QUARKUS-4489
https://issues.redhat.com/browse/QUARKUS-4490
https://issues.redhat.com/browse/QUARKUS-4491
https://issues.redhat.com/browse/QUARKUS-4492
https://issues.redhat.com/browse/QUARKUS-4493
https://issues.redhat.com/browse/QUARKUS-4494
https://issues.redhat.com/browse/QUARKUS-4495
https://issues.redhat.com/browse/QUARKUS-4497
https://issues.redhat.com/browse/QUARKUS-4498
https://issues.redhat.com/browse/QUARKUS-4499
https://issues.redhat.com/browse/QUARKUS-4500
https://issues.redhat.com/browse/QUARKUS-4501
https://issues.redhat.com/browse/QUARKUS-4502
https://issues.redhat.com/browse/QUARKUS-4503
https://issues.redhat.com/browse/QUARKUS-4504
https://issues.redhat.com/browse/QUARKUS-4505
https://issues.redhat.com/browse/QUARKUS-4506
https://issues.redhat.com/browse/QUARKUS-4507
https://issues.redhat.com/browse/QUARKUS-4508
https://issues.redhat.com/browse/QUARKUS-4509
https://issues.redhat.com/browse/QUARKUS-4510
https://issues.redhat.com/browse/QUARKUS-4511
https://issues.redhat.com/browse/QUARKUS-4512
https://issues.redhat.com/browse/QUARKUS-4514
https://issues.redhat.com/browse/QUARKUS-4515
https://issues.redhat.com/browse/QUARKUS-4516
https://issues.redhat.com/browse/QUARKUS-4517
https://issues.redhat.com/browse/QUARKUS-4518
https://issues.redhat.com/browse/QUARKUS-4519
https://issues.redhat.com/browse/QUARKUS-4520
https://issues.redhat.com/browse/QUARKUS-4522
https://issues.redhat.com/browse/QUARKUS-4523
https://issues.redhat.com/browse/QUARKUS-4525
https://issues.redhat.com/browse/QUARKUS-4526
https://issues.redhat.com/browse/QUARKUS-4527
https://issues.redhat.com/browse/QUARKUS-4529
https://issues.redhat.com/browse/QUARKUS-4530
https://issues.redhat.com/browse/QUARKUS-4531
https://issues.redhat.com/browse/QUARKUS-4532
https://issues.redhat.com/browse/QUARKUS-4533
https://issues.redhat.com/browse/QUARKUS-4534
https://issues.redhat.com/browse/QUARKUS-4535
https://issues.redhat.com/browse/QUARKUS-4536
https://issues.redhat.com/browse/QUARKUS-4537
https://issues.redhat.com/browse/QUARKUS-4538
https://issues.redhat.com/browse/QUARKUS-4539
https://issues.redhat.com/browse/QUARKUS-4540
https://issues.redhat.com/browse/QUARKUS-4541
https://issues.redhat.com/browse/QUARKUS-4542
https://issues.redhat.com/browse/QUARKUS-4543
https://issues.redhat.com/browse/QUARKUS-4544
https://issues.redhat.com/browse/QUARKUS-4545
https://issues.redhat.com/browse/QUARKUS-4547
https://issues.redhat.com/browse/QUARKUS-4548
https://issues.redhat.com/browse/QUARKUS-4549
https://issues.redhat.com/browse/QUARKUS-4550
https://issues.redhat.com/browse/QUARKUS-4551
https://issues.redhat.com/browse/QUARKUS-4552
https://issues.redhat.com/browse/QUARKUS-4553
https://issues.redhat.com/browse/QUARKUS-4608