2 results · Feed
-
Medium 6.3
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whe…
-
High 7.7
Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path …