Vulnerability · Published Dec 6, 2023 · Assigned by redhat
CVE-2023-6393Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
Medium 5.3
In plain English
A medium-severity information exposure in Red Hat build of Quarkus from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.quarkus:quarkus-cache | 3.5.2 | GHSA-xfv5-jqgp-vqhj |
| Maven | io.quarkus:quarkus-cache | 3.2.9.Final | GHSA-xfv5-jqgp-vqhj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Quarkus | see references |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2023:7700 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6393 vdb-entry, x_refsource_REDHAT
- RHBZ#2253113 issue-tracking, x_refsource_REDHAT