CVE-2023-4853

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Reserved 2023-09-08 | Published 2023-09-20 | Updated 2024-11-23 | Assigner redhat

Problem types

Improper Neutralization of Input Leaders

Product status

Default status
affected

0:1.9.2-3.el8 before *
unaffected

Default status
unaffected

Default status
affected

2.13.8.Final-redhat-00005 before *
unaffected

Default status
affected

2.13.8.Final-redhat-00005 before *
unaffected

Default status
affected

2.13.8.Final-redhat-00005 before *
unaffected

Default status
unaffected

Default status
affected

1.9.2-3 before *
unaffected

Default status
affected

1.30.1-1 before *
unaffected

Default status
affected

1.30.1-1 before *
unaffected

Default status
affected

1.9.2-3 before *
unaffected

Default status
affected

1.30.1-1 before *
unaffected

Default status
affected

1.30.1-1 before *
unaffected

Default status
affected

1.30.1-1 before *
unaffected

Default status
affected

1.30.0-5 before *
unaffected

Default status
affected

1.30.0-6 before *
unaffected

Default status
affected

1.30.0-6 before *
unaffected

Default status
affected

7.13.4-3 before *
unaffected

Default status
affected

7.13.4-2 before *
unaffected

Default status
affected

7.13.4-2 before *
unaffected

Default status
affected

7.13.4-3 before *
unaffected

Default status
affected

7.13.4-3 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

Timeline

2023-09-08:	Reported to Red Hat.
2023-09-08:	Made public.

References

access.redhat.com/errata/RHSA-2023:5170 (RHSA-2023:5170) vendor-advisory

access.redhat.com/errata/RHSA-2023:5310 (RHSA-2023:5310) vendor-advisory

access.redhat.com/errata/RHSA-2023:5337 (RHSA-2023:5337) vendor-advisory

access.redhat.com/errata/RHSA-2023:5446 (RHSA-2023:5446) vendor-advisory

access.redhat.com/errata/RHSA-2023:5479 (RHSA-2023:5479) vendor-advisory

access.redhat.com/errata/RHSA-2023:5480 (RHSA-2023:5480) vendor-advisory

access.redhat.com/errata/RHSA-2023:6107 (RHSA-2023:6107) vendor-advisory

access.redhat.com/errata/RHSA-2023:6112 (RHSA-2023:6112) vendor-advisory

access.redhat.com/errata/RHSA-2023:7653 (RHSA-2023:7653) vendor-advisory

access.redhat.com/security/cve/CVE-2023-4853 vdb-entry

access.redhat.com/security/vulnerabilities/RHSB-2023-002 (RHSB-2023-002) technical-description

bugzilla.redhat.com/show_bug.cgi?id=2238034 (RHBZ#2238034) issue-tracking

cve.org (CVE-2023-4853)

nvd.nist.gov (CVE-2023-4853)

Download JSON