CVE fixes - February 2025

Author: gsmet

_posts/2025-02-27-cve-fixes-feb-2025.adoc

@@ -0,0 +1,33 @@
+---
+layout: post
+title: 'CVE fixes - February 2025'
+date: 2025-02-27
+tags: release
+synopsis: 'We released Quarkus 3.8.6.1 and 3.15.3.1 with various CVE fixes. Quarkus 3.19.1 already has the fixes.'
+author: gsmet
+---
+
+Today, we released CVE fixes releases for Quarkus 3.8 LTS and 3.15 LTS to address several CVEs.
+
+If you are using these versions and the mentioned components, the update is recommended.
+
+These CVEs are already fixed in Quarkus 3.19.1,
+so if you are using a non-LTS version, please upgrade to Quarkus 3.19.1 (or to the closest LTS version if you are using an old version).
+
+We addressed the following CVEs:
+
+- https://nvd.nist.gov/vuln/detail/CVE-2025-24970[CVE-2025-24970] - Upstream Netty (only for 3.15)
+- https://nvd.nist.gov/vuln/detail/CVE-2025-1247[CVE-2025-1247] - Quarkus REST - Using field injection for request-scoped elements in REST resources not marked with the request scope could lead to concurrency issues.
+- https://nvd.nist.gov/vuln/detail/CVE-2024-12225[CVE-2024-12225] (embargo will be lifted soon) - WebAuthn - The callback endpoint was enabled by default. It now requires to be https://quarkus.io/version/3.15/guides/security-webauthn#configuration[explicitly configured].
+- https://nvd.nist.gov/vuln/detail/CVE-2025-1634[CVE-2025-1634] (not published yet) - RESTEasy Classic - RESTEasy Classic endpoints may be affected by memory leaks. If you are exposing REST endpoints publicly using the `quarkus-resteasy` extension, the update is highly recommended. Quarkus REST is **NOT** affected by this CVE.
+
+== Come Join Us
+
+We value your feedback a lot so please report bugs, ask for improvements... Let's build something great together!
+
+If you are a Quarkus user or just curious, don't be shy and join our welcoming community:
+
+ * provide feedback on https://github.com/quarkusio/quarkus/issues[GitHub];
+ * craft some code and https://github.com/quarkusio/quarkus/pulls[push a PR];
+ * discuss with us on https://quarkusio.zulipchat.com/[Zulip] and on the https://groups.google.com/d/forum/quarkus-dev[mailing list];
+ * ask your questions on https://stackoverflow.com/questions/tagged/quarkus[Stack Overflow].