5.3
Moyenne
CVE-2023-6393 A flaw was found in the Quarkus Cache Runtime
Description
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat build of Quarkus 2.13.9.Final 2.13 | premières → < 2.13.9.Final-redhat-00002 | 2.13.9.Final-redhat-00002 |
| Red Hat build of Quarkus | Versions non publiées |
Références
- RHSA-2023:7700 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2253113 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat build of Quarkus 2.13.9.Final
Les 4 CVE de Red Hat build of Quarkus 2.13.9.Final →
CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
6.5
Moyenne
CVE-2023-6267
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
8.6
Élevée
CVE-2023-6394
A flaw was found in Quarkus
7.4
Élevée