CVSS: 8.1EPSS: 0%CPEs: 18EXPL: 1CVE-2023-4853 – Quarkus: http security policy bypass
https://notcve.org/view.php?id=CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. Se encontró una falla en Quarkus donde las políticas de seguridad HTTP no sanitiza correctamente ciertas permutaciones de caracteres al aceptar solicitudes, lo que resulta en una evaluación incorrecta de los permisos. Este problema podría permitir que un atacante eluda la política de seguridad por completo, lo que resultaría en un acceso no autorizado al endpoint y posiblemente una Denegación de Servicio. • https://access.redhat.com/errata/RHSA-2023:5170 https://access.redhat.com/errata/RHSA-2023:5310 https://access.redhat.com/errata/RHSA-2023:5337 https://access.redhat.com/errata/RHSA-2023:5446 https://access.redhat.com/errata/RHSA-2023:5479 https://access.redhat.com/errata/RHSA-2023:5480 https://access.redhat.com/errata/RHSA-2023:6107 https://access.redhat.com/errata/RHSA-2023:6112 https://access.redhat.com/errata/RHSA-2023:7653 https://access.redhat.com/security/cve&# • CWE-148: Improper Neutralization of Input Leaders CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2974 – Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol
https://notcve.org/view.php?id=CVE-2023-2974
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol. • https://access.redhat.com/errata/RHSA-2023:3809 https://access.redhat.com/security/cve/CVE-2023-2974 https://bugzilla.redhat.com/show_bug.cgi?id=2211026 • CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') •