[RHSA-2023:5446-01] Important: Red Hat Build of OptaPlanner 8.38.0 SP1

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Build of OptaPlanner 8.38.0 SP1
Advisory ID:       RHSA-2023:5446-01
Product:           Red Hat build of OptaPlanner
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5446
Issue date:        2023-10-04
CVE Names:         CVE-2023-4853 
=====================================================================

1. Summary:

Red Hat build of OptaPlanner 8.38.0 for Quarkus 2.13.8 release and security
update is now available. The purpose of this text-only errata is to inform
you about the security issues fixed.

Red Hat Product Security has rated this update as having an impact of
Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
links in the References section.

2. Description:

Release of Red Hat build of OptaPlanner 8.38.0 SP1

This release includes security fixes.

Security Fix(es):

* org.kie.kogito-kogito-apps: quarkus: HTTP security policy bypass
(CVE-2023-4853)

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2238034 - CVE-2023-4853 quarkus: HTTP security policy bypass

5. References:

https://access.redhat.com/security/cve/CVE-2023-4853
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHdiIAAoJENzjgjWX9erEHWMP+wZBfZ+ZvAFMsjKwVgya6Q81
Z2QgItsc42kY/BSA0bEN8ntMs970onO2A8kI1OSi03ABugtyWT3k0V55UmpxuJZd
SDpsdfgYxMCFRljUYzT0Z5u3iMTlN0eS/PKG/3X6L3M7DTfHHvbmNWutGAFM8S1y
lJf8lyFHPzP6lGSVzralmppFhiZddsniEZbrGudV9so/splybAutRLMIZRyE744l
dvDrEDyIFr+uG6UC+T+Fi1czj7BCNGJVOmEH3oTDAXnEUJCs+GFRwAcRzbaPpOnL
FdvgS1t60FLiNjfwa3RfWXB21mw5jvIktqWuvUakuAiQD8ERULOOot9cqNLv6J9F
DjKYKZY1WeR0GcqtmR/YWRVSqCpFMFril999FwHSAaSHzxLUv2dM7+UdIf/sLXoa
RJFxhMv2NuC58pTWKgpXMbRT1Ik6PJawcwGz6eBi1XY3iFNGxWdnO/+76Gc+F34q
R5bpyGS736V3yujHkZ9ucIAyWz0oEmGiZ3MomLqdAwL+cok4R247d/5/I5fmPYyk
1W+GORmOpr8iHFRythNpGXxkToUx9OyO5xd/6VSpsraRt8KWsNwS8Jht3o8DtC+c
Ub71d64JqyKYNvWInJmhbfNeXBXPbbelikNWm0yWwe8h6u9e+I06pZJTnzSXT3SR
bU+anCGr0RTy7THHUnjt
=W+I2
-----END PGP SIGNATURE-----