Log in Start free

Vulnerability · Published Sep 20, 2023 · Assigned by redhat

CVE-2023-4853Quarkus: http security policy bypass

High 8.1

In plain English

A high-severity security flaw in Openshift Serverless 1 on RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.quarkus:quarkus-csrf-reactive2.16.11.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-csrf-reactive3.3.3GHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-csrf-reactive3.2.6.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-keycloak-authorization3.3.3GHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-keycloak-authorization2.16.11.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-keycloak-authorization3.2.6.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-undertow2.16.11.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-undertow3.2.6.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-undertow3.3.3GHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-vertx-http3.3.3GHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-vertx-http3.2.6.FinalGHSA-4f4r-wgv2-jjvg
Mavenio.quarkus:quarkus-vertx-http2.16.11.FinalGHSA-4f4r-wgv2-jjvg

Affected products (as reported)

VendorProductVersions
Red Hat Openshift Serverless 1 on RHEL 8 see references
Red Hat Red Hat build of OptaPlanner 8 see references
Red Hat Red Hat build of Quarkus 2.13.8.SP2 see references
Red Hat Red Hat build of Quarkus 2.13.8.SP2 see references
Red Hat Red Hat build of Quarkus 2.13.8.SP2 see references
Red Hat Red Hat Camel Extensions for Quarkus 2.13.3-1 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat Red Hat OpenShift Serverless 1.30 see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHINT Camel-K-1.10.2 see references
Red Hat RHINT Service Registry 2.5.4 GA see references
Red Hat RHPAM 7.13.4 async see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Integration Camel Quarkus 2 see references
Red Hat Red Hat Process Automation 7 see references

Weakness: CWE-148 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References