Skip to content
fr Sign in
8.1 High

CVE-2023-4853 Quarkus: http security policy bypass

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
Openshift Serverless 1 on RHEL 8 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat build of Quarkus 2.13.8.SP2 2.13 earliest → < 2.13.8.Final-redhat-00005 2.13.8.Final-redhat-00005
Red Hat Camel Extensions for Quarkus 2.13.3-1 Versions not published
Red Hat OpenShift Serverless 1.30 1.30 earliest → < 1.30.0-6 1.30.0-6
RHEL-8 based Middleware Containers 7.13 earliest → < 7.13.4-3 7.13.4-3
RHINT Camel-K-1.10.2 Versions not published
RHINT Service Registry 2.5.4 GA Versions not published
RHPAM 7.13.4 async Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat Process Automation 7 Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Integration Camel Quarkus 2 Versions not published

References

Timeline

  1. Published
  2. Last modified
Track this CVE