GHSA-4f4r-wgv2-jjvg
Quarkus HTTP vulnerable to incorrect evaluation of permissions
At a glance
- Published
- Updated
- CVE
- CVE-2023-4853
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.quarkus:quarkus-vertx-http | introduced 0, fixed 2.16.11.Final |
| Maven · io.quarkus:quarkus-vertx-http | introduced 3.0.0, fixed 3.2.6.Final |
| Maven · io.quarkus:quarkus-vertx-http | introduced 3.3.0, fixed 3.3.3 |
| Maven · io.quarkus:quarkus-undertow | introduced 0, fixed 2.16.11.Final |
| Maven · io.quarkus:quarkus-undertow | introduced 3.0.0, fixed 3.2.6.Final |
| Maven · io.quarkus:quarkus-undertow | introduced 3.3.0, fixed 3.3.3 |
| Maven · io.quarkus:quarkus-csrf-reactive | introduced 0, fixed 2.16.11.Final |
| Maven · io.quarkus:quarkus-csrf-reactive | introduced 3.0.0, fixed 3.2.6.Final |
| Maven · io.quarkus:quarkus-csrf-reactive | introduced 3.3.0, fixed 3.3.3 |
| Maven · io.quarkus:quarkus-keycloak-authorization | introduced 0, fixed 2.16.11.Final |
| Maven · io.quarkus:quarkus-keycloak-authorization | introduced 3.0.0, fixed 3.2.6.Final |
| Maven · io.quarkus:quarkus-keycloak-authorization | introduced 3.3.0, fixed 3.3.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-4853 ADVISORY
- https://github.com/quarkusio/quarkus/issues/35785 WEB
- https://github.com/quarkusio/quarkus/discussions/35940 WEB
- https://github.com/quarkusio/quarkus PACKAGE
- https://bugzilla.redhat.com/show_bug.cgi?id=2238034 WEB
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 WEB
- https://access.redhat.com/security/cve/CVE-2023-4853 WEB
- https://access.redhat.com/errata/RHSA-2023:7653 WEB
- https://access.redhat.com/errata/RHSA-2023:6112 WEB
- https://access.redhat.com/errata/RHSA-2023:6107 WEB
- https://access.redhat.com/errata/RHSA-2023:5480 WEB
- https://access.redhat.com/errata/RHSA-2023:5479 WEB
- https://access.redhat.com/errata/RHSA-2023:5446 WEB
- https://access.redhat.com/errata/RHSA-2023:5337 WEB
- https://access.redhat.com/errata/RHSA-2023:5310 WEB
- https://access.redhat.com/errata/RHSA-2023:5170 WEB
- https://access.redhat.com/articles/11258 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |