5.3
Medium
CVE-2023-6393 A flaw was found in the Quarkus Cache Runtime
Description
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Quarkus 2.13.9.Final 2.13 | earliest → < 2.13.9.Final-redhat-00002 | 2.13.9.Final-redhat-00002 |
| Red Hat build of Quarkus | Versions not published |
References
- RHSA-2023:7700 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2253113 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Quarkus 2.13.9.Final
The 4 CVEs of Red Hat build of Quarkus 2.13.9.Final →
CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
6.5
Medium
CVE-2023-6267
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
8.6
High
CVE-2023-6394
A flaw was found in Quarkus
7.4
High