Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2023-4853

Quarkus: http security policy bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Openshift Serverless 1 on RHEL 8

Default version status: affected

  • 0:1.9.2-3.el8 to < *unaffected

Red Hat Red Hat build of OptaPlanner 8

Default version status: unaffected

Red Hat Red Hat build of Quarkus 2.13.8.SP2

Default version status: affected

  • 2.13.8.Final-redhat-00005 to < *unaffected

Red Hat Red Hat build of Quarkus 2.13.8.SP2

Default version status: affected

  • 2.13.8.Final-redhat-00005 to < *unaffected

Red Hat Red Hat build of Quarkus 2.13.8.SP2

Default version status: affected

  • 2.13.8.Final-redhat-00005 to < *unaffected

Red Hat Red Hat Camel Extensions for Quarkus 2.13.3-1

Default version status: unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.9.2-3 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.1-1 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.1-1 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.9.2-3 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.1-1 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.1-1 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.1-1 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.0-5 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.0-6 to < *unaffected

Red Hat Red Hat OpenShift Serverless 1.30

Default version status: affected

  • 1.30.0-6 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.13.4-3 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.13.4-2 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.13.4-2 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.13.4-3 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.13.4-3 to < *unaffected

Red Hat RHINT Camel-K-1.10.2

Default version status: unaffected

Red Hat RHINT Service Registry 2.5.4 GA

Default version status: unaffected

Red Hat RHPAM 7.13.4 async

Default version status: unaffected

Red Hat Red Hat build of Quarkus

Default version status: affected

Red Hat Red Hat build of Quarkus

Default version status: affected

Red Hat Red Hat Process Automation 7

Default version status: affected

References