An update for the quarkus-mandrel-java and quarkus-mandrel-231 packages is
now available for the Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

The quarkus-mandrel-java and quarkus-mandrel-231 packages provide the
GraalVM installation for the quarkus/mandrel-for-jdk-21-rhel8:23.1 container
 image on top of the latest release of OpenJDK 21.0.3.

Security Fix(es):

* org.graalvm.compiler/compiler: graalvm: Unauthorized Read Access
(CVE-2024-20954)

* org.graalvm.compiler/compiler: graalvm: unauthorized ability to cause a
 partial denial of service
(CVE-2024-21098)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-20954: Improper Access Control (CWE-284)
CVE-2024-21098: Improper Authorization (CWE-285)