~ / search / GHSA-4f4r-wgv2-jjvg

GHSA-4f4r-wgv2-jjvg

Quarkus HTTP vulnerable to incorrect evaluation of permissions

Source: GitHub Advisory Database (reviewed) High CVE-2023-4853

Packages

EcosystemPackageAffectedFixed in
Maven io.quarkus:quarkus-vertx-http < 2.16.11.Final 2.16.11.Final
Maven io.quarkus:quarkus-vertx-http >= 3.0.0, < 3.2.6.Final 3.2.6.Final
Maven io.quarkus:quarkus-vertx-http >= 3.3.0, < 3.3.3 3.3.3
Maven io.quarkus:quarkus-undertow < 2.16.11.Final 2.16.11.Final
Maven io.quarkus:quarkus-undertow >= 3.0.0, < 3.2.6.Final 3.2.6.Final
Maven io.quarkus:quarkus-undertow >= 3.3.0, < 3.3.3 3.3.3
Maven io.quarkus:quarkus-csrf-reactive < 2.16.11.Final 2.16.11.Final
Maven io.quarkus:quarkus-csrf-reactive >= 3.0.0, < 3.2.6.Final 3.2.6.Final
Maven io.quarkus:quarkus-csrf-reactive >= 3.3.0, < 3.3.3 3.3.3
Maven io.quarkus:quarkus-keycloak-authorization < 2.16.11.Final 2.16.11.Final
Maven io.quarkus:quarkus-keycloak-authorization >= 3.0.0, < 3.2.6.Final 3.2.6.Final
Maven io.quarkus:quarkus-keycloak-authorization >= 3.3.0, < 3.3.3 3.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

References

External links from the advisory. They lead to third-party sites.