IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.1Yüksek

CVE-2023-4853Quarkus: http security policy bypass

Red Hat Openshift Serverless 1 on RHEL 8; Red Hat Red Hat build of OptaPlanner 8; Red Hat Red Hat build of Quarkus 2.13.8.SP2; Red Hat Red Hat Camel Extensions… Yayım: (3 yıl önce)

Açıklama

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Zayıflık türü (CWE): CWE-148CWE-863

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
openshift serverless 1.30 —
quarkus quarkus < 2.16.11
redhat build of optaplanner 8.0
redhat build of quarkus 2.13.0 – < 2.13.8
redhat decision manager 7.0
redhat integration camel k < 1.10.2
redhat integration camel quarkus —
redhat integration service registry —
redhat jboss middleware 1
redhat jboss middleware text-only advisories 1.0
redhat openshift container platform 4.10
redhat openshift serverless 1.0
Red Hat Openshift Serverless 1 on RHEL 8 all versions
redhat process automation manager 7.0
Red Hat Red Hat build of OptaPlanner 8 —
Red Hat Red Hat build of Quarkus all versions
Red Hat Red Hat build of Quarkus 2.13.8.SP2 all versions
Red Hat Red Hat Camel Extensions for Quarkus 2.13.3-1 —
Red Hat Red Hat Integration Camel Quarkus 2 all versions
Red Hat Red Hat OpenShift Serverless 1.30 all versions
Red Hat Red Hat Process Automation 7 all versions
Red Hat RHEL-8 based Middleware Containers all versions
Red Hat RHINT Camel-K-1.10.2 —
Red Hat RHINT Service Registry 2.5.4 GA —
Red Hat RHPAM 7.13.4 async —
rhosemc 1.0 —
serverless 1.0 —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (17)
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* < 2.16.11
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.2.6
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.3.0 < 3.3.3
  • cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:text-only:*:*:* ≥ 2.13.0 < 2.13.8
  • cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* < 1.10.2
  • cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
  • cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_serverless:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:process_automation_manager:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*