Any plan to address these vulnerabilities? #36814

pavelnemirovsky · 2025-01-26T10:21:13Z

pavelnemirovsky
Jan 26, 2025

Description

Report produced by Aqua Security and Docker Scout Scanners:

┌────────────────────────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│                      Library                       │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├────────────────────────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ io.netty:netty-common                              │ CVE-2024-47535 │ MEDIUM   │ fixed    │ 4.1.111.Final     │ 4.1.115       │ netty: Denial of Service attack on windows app using Netty   │
│ (io.netty.netty-common-4.1.111.Final.jar)          │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-47535                   │
├────────────────────────────────────────────────────┼────────────────┼──────────┤          ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ io.quarkus.http:quarkus-http-core                  │ CVE-2024-12397 │ HIGH     │          │ 5.3.2             │ 5.3.4         │ io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie       │
│ (io.quarkus.http.quarkus-http-core-5.3.2.jar)      │                │          │          │                   │               │ Smuggling                                                    │
│                                                    │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-12397                   │
├────────────────────────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ org.keycloak:keycloak-ldap-federation              │ CVE-2025-0604  │ MEDIUM   │ affected │ 26.0.6            │               │ keycloak-ldap-federation: Authentication Bypass Due to       │
│ (org.keycloak.keycloak-ldap-federation-26.0.6.jar) │                │          │          │                   │               │ Missing LDAP Bind After Password Reset in...                 │
│                                                    │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2025-0604                    │
├────────────────────────────────────────────────────┼────────────────┤          ├──────────┤                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│ org.keycloak:keycloak-quarkus-server               │ CVE-2024-11734 │          │ fixed    │                   │ 26.0.8        │ org.keycloak:keycloak-quarkus-server: Denial of Service in   │
│ (org.keycloak.keycloak-quarkus-server-26.0.6.jar)  │                │          │          │                   │               │ Keycloak Server via Security Headers                         │
│                                                    │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-11734                   │
│                                                    ├────────────────┤          │          │                   │               ├──────────────────────────────────────────────────────────────┤
│                                                    │ CVE-2024-11736 │          │          │                   │               │ org.keycloak:keycloak-quarkus-server: Unrestricted admin use │
│                                                    │                │          │          │                   │               │ of system and environment variables                          │
│                                                    │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-11736                   │
└────────────────────────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

ahrycej · 2025-03-27T11:12:44Z

ahrycej
Mar 27, 2025

this discussion has been opened and issue ticket closed
#36813
however nobody commented it,
need to know when CVE-2025-0604 will be addressed?

0 replies

ahrycej · 2025-03-27T11:15:31Z

ahrycej
Mar 27, 2025

https://access.redhat.com/security/cve/CVE-2025-0604

0 replies

Xulunix · 2025-03-27T13:25:09Z

Xulunix
Mar 27, 2025

The description of 0604 sounds like GHSA-2p82-5wwr-43cw
Which has been fixed with 26.1.3 and 26.0.10

0 replies

Navigation Menu

Repository navigation

Any plan to address these vulnerabilities? #36814

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Any plan to address these vulnerabilities? #36814

Uh oh!

Uh oh!

pavelnemirovsky Jan 26, 2025

Description

Replies: 3 comments

Uh oh!

ahrycej Mar 27, 2025

Uh oh!

ahrycej Mar 27, 2025

Uh oh!

Xulunix Mar 27, 2025

pavelnemirovsky
Jan 26, 2025

ahrycej
Mar 27, 2025

ahrycej
Mar 27, 2025

Xulunix
Mar 27, 2025