csaf_redhat - rhsa-2025:13012

rhsa-2025:13012

Vulnerability from csaf_redhat

Published

2025-08-07 10:51

Modified

2025-08-07 15:07

Summary

Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6 release and security update

Notes

Topic

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Details

This release of Red Hat build of Quarkus 3.15.6 includes the following CVE fixes: * quarkus-bom: pgjdbc insecure authentication in channel binding [quarkus-3.15] (CVE-2025-49146) * quarkus-bom: Quarkus potential data leak [quarkus-3.15] (CVE-2025-49574) For more information, see the release notes page listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.15.6 includes the following CVE fixes:\n\n* quarkus-bom: pgjdbc insecure authentication in channel binding [quarkus-3.15] (CVE-2025-49146)\n\n* quarkus-bom: Quarkus potential data leak [quarkus-3.15] (CVE-2025-49574)\n\nFor more information, see the release notes page listed in the References\nsection.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:13012",
        "url": "https://access.redhat.com/errata/RHSA-2025:13012"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/4966181",
        "url": "https://access.redhat.com/articles/4966181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.15.6",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.15.6"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/3.15",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/3.15"
      },
      {
        "category": "external",
        "summary": "QUARKUS-5632",
        "url": "https://issues.redhat.com/browse/QUARKUS-5632"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6294",
        "url": "https://issues.redhat.com/browse/QUARKUS-6294"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6318",
        "url": "https://issues.redhat.com/browse/QUARKUS-6318"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6320",
        "url": "https://issues.redhat.com/browse/QUARKUS-6320"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6328",
        "url": "https://issues.redhat.com/browse/QUARKUS-6328"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6331",
        "url": "https://issues.redhat.com/browse/QUARKUS-6331"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6332",
        "url": "https://issues.redhat.com/browse/QUARKUS-6332"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13012.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6 release and security update",
    "tracking": {
      "current_release_date": "2025-08-07T15:07:21+00:00",
      "generator": {
        "date": "2025-08-07T15:07:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:13012",
      "initial_release_date": "2025-08-07T10:51:36+00:00",
      "revision_history": [
        {
          "date": "2025-08-07T10:51:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-08-07T10:51:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-07T15:07:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.15.6",
                "product": {
                  "name": "Red Hat build of Quarkus 3.15.6",
                  "product_id": "Red Hat build of Quarkus 3.15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.15::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-49146",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2025-06-11T15:01:33.735376+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A connection handling flaw was found in the pgjdbc connection driver in configurations that require channel binding. Connections created with authentication methods that should not allow channel binding permit connections to use channel binding. This flaw allows attackers to position themselves in the middle of a connection and intercept the connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pgjdbc: pgjdbc insecure authentication in channel binding",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.15.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49146"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49146",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49146"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49146",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49146"
        },
        {
          "category": "external",
          "summary": "https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0",
          "url": "https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0"
        },
        {
          "category": "external",
          "summary": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54",
          "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54"
        }
      ],
      "release_date": "2025-06-11T14:32:39.348000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-07T10:51:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:13012"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.15.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pgjdbc: pgjdbc insecure authentication in channel binding"
    },
    {
      "cve": "CVE-2025-49574",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "discovery_date": "2025-06-23T20:00:57.216622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2374376"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be unintentionally exposed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus/quarkus-vertx: Quarkus potential data leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.15.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49574"
        },
        {
          "category": "external",
          "summary": "RHBZ#2374376",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374376"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49574",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49574"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49574",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49574"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1",
          "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/issues/48227",
          "url": "https://github.com/quarkusio/quarkus/issues/48227"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4",
          "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"
        }
      ],
      "release_date": "2025-06-23T19:47:05.454000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-07T10:51:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:13012"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.15.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.quarkus/quarkus-vertx: Quarkus potential data leak"
    }
  ]
}

CVE-2025-49146 (GCVE-0-2025-49146)

Vulnerability from cvelistv5

Published

2025-06-11 14:32

Modified

2025-06-11 14:46

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-287 - Improper Authentication

Summary

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

References

►

URL

	Vendor	Product	Version
	pgjdbc	pgjdbc	Version: >= 42.7.4, < 42.7.7

CVE-2025-49574 (GCVE-0-2025-49574)

Vulnerability from cvelistv5

Published

2025-06-23 19:47

Modified

2025-06-24 13:33

Severity ?

6.4 (Medium) - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-668 - Exposure of Resource to Wrong Sphere

Summary

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.0, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.0.

References

►

URL

	Vendor	Product	Version
	quarkusio	quarkus	Version: < 3.24.0

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:13012

Vulnerability from csaf_redhat

CVE-2025-49146 (GCVE-0-2025-49146)

Vulnerability from cvelistv5

CVE-2025-49574 (GCVE-0-2025-49574)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature