NetSight
IP …
high8.1

CVE-2023-4853

Quarkus HTTP vulnerable to incorrect evaluation of permissions

Impact

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected packages

EcosystemPackageAffectedFixed in
mavenio.quarkus:quarkus-vertx-http< 2.16.11.Final2.16.11.Final
mavenio.quarkus:quarkus-undertow< 2.16.11.Final2.16.11.Final
mavenio.quarkus:quarkus-csrf-reactive< 2.16.11.Final2.16.11.Final
mavenio.quarkus:quarkus-keycloak-authorization< 2.16.11.Final2.16.11.Final

Affected products

VendorProductAffected versions
QuarkusQuarkus
before 2.16.11
from 3.2.0 before 3.2.6
from 3.3.0 before 3.3.3
RedhatBuild Of Optaplanner
Version 8.0
RedhatBuild Of Quarkus
from 2.13.0 before 2.13.8
RedhatDecision Manager
Version 7.0
RedhatIntegration Camel K
before 1.10.2
RedhatIntegration Camel Quarkus
All versions
RedhatIntegration Service Registry
All versions
RedhatJboss Middleware
Version 1
RedhatJboss Middleware Text-Only Advisories
Version 1.0
RedhatOpenshift Serverless
All versions
Version 1.0
RedhatProcess Automation Manager
Version 7.0
RedhatOpenshift Container Platform
Versions 4.10, 4.11, 4.12

Weakness classification

CWE-148CWE-863

References