GHSA-3fhx-3vvg-2j84

quarkus-core vulnerable to client driven TLS cipher downgrading

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2974

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.quarkus:quarkus-core	< 2.16.8.Final	2.16.8.Final

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2974 advisory
https://github.com/quarkusio/quarkus/pull/34469 web
https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935 web
https://access.redhat.com/errata/RHSA-2023:3809 web
https://access.redhat.com/security/cve/CVE-2023-2974 web
https://bugzilla.redhat.com/show_bug.cgi?id=2211026 web
https://github.com/quarkusio/quarkus package