Red Hat Security Advisory

RHSA-2023:5170

Red Hat build of Quarkus 2.13.8 release and security update

Released 2023-09-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus 2.13.8.SP2 io.quarkus.quarkus-keycloak-authorization-2.13.8.Final-redhat-00005.jar, io.quarkus.quarkus-undertow-2.13.8.Final-redhat-00005.jar, io.quarkus.quarkus-vertx-http-2.13.8.Final-redhat-00005.jar

Fixes 1 record

TI-2023-04469 CVE-2023-4853 · GHSA-4f4r-wgv2-jjvg

Quarkus: http security policy bypass

MEDIUM 40

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02276 Published 2023-09-20 Partial fix · 1.9.2-3.el8, 2.13.8.Final-redhat-00005 +9 CWE-148