Quarkus: http security policy bypass
CVE-2023-4853
8.1HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 20 September 2023
What is CVE-2023-4853?
A vulnerability in Quarkus has been identified where HTTP security policies fail to correctly sanitize certain character permutations in incoming requests. This flaw may lead to the incorrect evaluation of permissions, enabling an attacker to circumvent the security policy. Such exploitation could allow unauthorized access to sensitive endpoints and potentially trigger a denial of service.
Affected Version(s)
Openshift Serverless 1 on RHEL 8 0:1.9.2-3.el8
Red Hat build of Quarkus 2.13.8.SP2 2.13.8.Final-redhat-00005
Red Hat build of Quarkus 2.13.8.SP2 2.13.8.Final-redhat-00005