What it is about

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution. Ein entfernter Angreifer kann mehrere Schwachstellen in Quarkus auf Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, oder einen Denial of Service auszulösen.

Under what conditions?

Over the network.

What can happen in the worst case

An attacker could use the vulnerability to

• Informationen offenzulegen
• oder einen Denial of Service auszulösen

Am I affected?

Affected according to the BSI:

• IBM Maximo Asset Management 7.6.1
• IBM InfoSphere Information Server 11.7
• Red Hat Enterprise Linux
• IBM SPSS Analytic Server
• IBM License Metric Tool
• IBM SAN Volume Controller
• IBM QRadar SIEM
• IBM FlashSystem
• Red Hat Integration
• Hitachi Ops Center
• Red Hat Enterprise Linux Quarkus <3.8.6.SP3
• Red Hat Enterprise Linux Quarkus <3.15.3.SP1

and 12 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Red Hat Enterprise Linux Quarkus 3.8.6.SP3
• Red Hat Enterprise Linux Quarkus 3.15.3.SP1
• Red Hat JBoss Data Grid 8.5.3
• Atlassian Bamboo 10.2.2
• Atlassian Bamboo 9.6.11
• Red Hat JBoss Enterprise Application Platform 7.4.21
• IBM Operational Decision Manager V8.11.0.1 Interim fix 042
• IBM Operational Decision Manager V8.11.1.0: Interim fix 039
• IBM Operational Decision Manager V8.12.0.1: Interim fix 024
• IBM Operational Decision Manager V9.0.0.1: Interim fix 007
• Red Hat Enterprise Linux Quarkus 3.20.1
• Dell Secure Connect Gateway 5.34.00.16

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.