RHBA-2024:4080 - Bug Fix Advisory

Topic

An update for the quarkus/mandrel-for-jdk-21-rhel8:23.1 container image is
now available for the Red Hat build of Quarkus 3.8

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

The quarkus/mandrel-for-jdk-21-rhel8:23.1 container image provides a native-image installation based on the Mandrel distribution of GraalVM community for JDK 21 for the Red Hat Build of Quarkus 3.8

Security Fix(es):

• org.graalvm.compiler/compiler: graalvm: Unauthorized Read Access

(CVE-2024-20954)

• org.graalvm.compiler/compiler: graalvm: unauthorized ability to cause a

partial denial of service
(CVE-2024-21098)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution

The quarkus/mandrel-for-jdk-21-rhel8:23.1 container image provided by this
update can be downloaded from the Red Hat Container Registry at
registry.access.redhat.com. Installation instructions for your platform are
available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image
specifically, or to the latest image generally.

Affected Products

• Red Hat build of Quarkus 3 x86_64
• Red Hat build of Quarkus 3 aarch64

Fixes

• BZ - 2278636 - CVE-2024-20954 graalvm: Unauthorized Read Access
• BZ - 2278674 - CVE-2024-21098 graalvm: unauthorized ability to cause a partial denial of service

CVEs

• CVE-2024-20954
• CVE-2024-21098

References

• https://catalog.redhat.com/software/containers/registry/registry.access.redhat.com/repository/quarkus/mandrel-for-jdk-21-rhel8