← CVE Intelligence

CVE-2023-4853

Quarkus: http security policy bypass PUBLISHED

Description (CNA)

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected (CNA)

Vendor / productVersions
Red Hat / Openshift Serverless 1 on RHEL 8unaffected 0:1.9.2-3.el8 before *
Red Hat / Red Hat build of OptaPlanner 8unaffected
Red Hat / Red Hat build of Quarkus 2.13.8.SP2unaffected 2.13.8.Final-redhat-00005 before *
Red Hat / Red Hat build of Quarkus 2.13.8.SP2unaffected 2.13.8.Final-redhat-00005 before *
Red Hat / Red Hat build of Quarkus 2.13.8.SP2unaffected 2.13.8.Final-redhat-00005 before *
Red Hat / Red Hat Camel Extensions for Quarkus 2.13.3-1unaffected
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.9.2-3 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.1-1 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.1-1 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.9.2-3 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.1-1 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.1-1 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.1-1 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.0-5 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.0-6 before *
Red Hat / Red Hat OpenShift Serverless 1.30unaffected 1.30.0-6 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.13.4-3 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.13.4-2 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.13.4-2 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.13.4-3 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.13.4-3 before *
Red Hat / RHINT Camel-K-1.10.2unaffected
Red Hat / RHINT Service Registry 2.5.4 GAunaffected
Red Hat / RHPAM 7.13.4 asyncunaffected
Red Hat / Red Hat build of Quarkusaffected
Red Hat / Red Hat build of Quarkusaffected
Red Hat / Red Hat Process Automation 7affected

CWE

CWE-148

References

ADP enrichment

CVE

No English description supplied.