GHSA-g56w-cwg4-hxx9

Code injection in quarkus dev ui config editor

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-4116

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.quarkus:quarkus-vertx-http-deployment	>= 2.14.0, < 2.14.2.Final	2.14.2.Final
Maven	io.quarkus:quarkus-vertx-http-deployment	< 2.13.5.Final	2.13.5.Final

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-4116 advisory
https://access.redhat.com/security/cve/CVE-2022-4116 web
https://bugzilla.redhat.com/show_bug.cgi?id=2144748 web
https://github.com/quarkusio/quarkus package
https://github.com/quarkusio/quarkus/discussions/29527 web
https://github.com/quarkusio/quarkus/discussions/29527#discussioncomment-4387809 web