Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Remediation

References

https://access.redhat.com/errata/RHSA-2023:5310

https://access.redhat.com/security/cve/CVE-2023-4853

https://bugzilla.redhat.com/show_bug.cgi?id=2238034

https://access.redhat.com/security/vulnerabilities/RHSB-2023-002

https://access.redhat.com/errata/RHSA-2023:5170

https://access.redhat.com/errata/RHSA-2023:5337

https://access.redhat.com/errata/RHSA-2023:5446

https://access.redhat.com/errata/RHSA-2023:5479

https://access.redhat.com/errata/RHSA-2023:5480

https://access.redhat.com/errata/RHSA-2023:6107

https://access.redhat.com/errata/RHSA-2023:6112

https://access.redhat.com/errata/RHSA-2023:7653

Related Vulnerabilities

CVE-2020-8203 Vulnerability in maven package org.webjars:lodash

CVE-2018-5382 Vulnerability in maven package org.bouncycastle:bcprov-jdk16

CVE-2019-9658 Vulnerability in maven package com.puppycrawl.tools:checkstyle

CVE-2023-28682 Vulnerability in maven package org.jenkins-ci.plugins:perfpublisher

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-api

Severity

Critical

Classification

CWE-863 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Mitigation Issue Tracking Exploit Technical Description