Quarkus: http security policy bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.16.11.Final, 3.2.6.Final, 3.3.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Timeline
- CVE published
- Record last updated
Affected versions
- openshift-serverless-clients
Version range not reported
- quarkus-vertx-http
Version range not reported
- io.quarkus/quarkus-keycloak-authorization
Version range not reported
- io.quarkus/quarkus-undertow
Version range not reported
- io.quarkus/quarkus-vertx-http
Version range not reported
- quarkus-vertx-http
Version range not reported
- openshift-serverless-1/client-kn-rhel8
Version range not reported
- openshift-serverless-1/ingress-rhel8-operator
Version range not reported
- openshift-serverless-1/knative-rhel8-operator
Version range not reported
- openshift-serverless-1/kn-cli-artifacts-rhel8
Version range not reported
- openshift-serverless-1/serverless-operator-bundle
Version range not reported
- openshift-serverless-1/serverless-rhel8-operator
Version range not reported
- openshift-serverless-1/svls-must-gather-rhel8
Version range not reported
- openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8
Version range not reported
- openshift-serverless-1-tech-preview/logic-swf-builder-rhel8
Version range not reported
- openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8
Version range not reported
- rhpam-7/rhpam-kogito-builder-rhel8
Version range not reported
- rhpam-7/rhpam-kogito-rhel8-operator
Version range not reported
- rhpam-7/rhpam-kogito-rhel8-operator-bundle
Version range not reported
- rhpam-7/rhpam-kogito-runtime-jvm-rhel8
Version range not reported
- rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8
Version range not reported
- quarkus-vertx-http
Version range not reported
- quarkus-vertx-http
Version range not reported
- Red Hat RHPAM 7.13.4 async
Version range not reported
- quarkus-keycloak-authorization
Version range not reported
- quarkus-undertow
Version range not reported
- quarkus-vertx-http
Version range not reported
- io.quarkus:quarkus-vertx-httpMaven
fixed in 2.16.11.Final
- io.quarkus:quarkus-vertx-httpMaven
From 3.0.0 · fixed in 3.2.6.Final
- io.quarkus:quarkus-vertx-httpMaven
From 3.3.0 · fixed in 3.3.3
- io.quarkus:quarkus-undertowMaven
fixed in 2.16.11.Final
- io.quarkus:quarkus-undertowMaven
From 3.0.0 · fixed in 3.2.6.Final
- io.quarkus:quarkus-undertowMaven
From 3.3.0 · fixed in 3.3.3
- io.quarkus:quarkus-csrf-reactiveMaven
fixed in 2.16.11.Final
- io.quarkus:quarkus-csrf-reactiveMaven
From 3.0.0 · fixed in 3.2.6.Final
- io.quarkus:quarkus-csrf-reactiveMaven
From 3.3.0 · fixed in 3.3.3
- io.quarkus:quarkus-keycloak-authorizationMaven
fixed in 2.16.11.Final
- io.quarkus:quarkus-keycloak-authorizationMaven
From 3.0.0 · fixed in 3.2.6.Final
- io.quarkus:quarkus-keycloak-authorizationMaven
From 3.3.0 · fixed in 3.3.3