Skip to content
OpenAdvisories
High WID-SEC-2024-0203 2 CVEs

Red Hat Enterprise Linux Quarkus: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Jan 25, 2024 · Updated Dec 17, 2024 · Revision 2 · de-DE

Vendor: Hitachi Vendor: Red Hat Product: Enterprise Linux Product: Ops Center Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 2

  • High 8.6
    CVE-2023-6267

    Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

    A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not ha…

    Red Hat Red Hat Fuse 7 Red Hat Integration Camel K 1 Red Hat build of OptaPlanner 8 Maven
  • Medium 6.5
    CVE-2023-5675

    Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.

    A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enf…

    Red Hat Red Hat JBoss Enterprise Application Platform 8 Red Hat Fuse 7 Red Hat Process Automation 7 Maven

Revision history

  1. #2

    Neue Updates von HITACHI aufgenommen

  2. #1

    Initiale Fassung

References