Description
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Openshift Serverless 1 on RHEL 8 | — | — |
| Red Hat | Red Hat build of OptaPlanner 8 | — | — |
| Red Hat | Red Hat build of Quarkus 2.13.8.SP2 | — | — |
| Red Hat | Red Hat Camel Extensions for Quarkus 2.13.3-1 | — | — |
| Red Hat | Red Hat OpenShift Serverless 1.30 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | RHINT Camel-K-1.10.2 | — | — |
| Red Hat | RHINT Service Registry 2.5.4 GA | — | — |
| Red Hat | RHPAM 7.13.4 async | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Integration Camel Quarkus 2 | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 1.9.2-3.el8 | RHSA-2023:5479 |
Affected packages
Advisories 3
- RHSA-2023:5479 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.30.1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2024-1769 Hitachi Ops Center: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Aug 5, 2024
- WID-SEC-2023-2362 Red Hat Quarkus: Schwachstelle ermöglicht die Umgehung von Sicherheitsmaßnahmen oder die Verursachung eines Denial-of-Service-Zustands BSI CERT-Bund (WID) · Jul 1, 2024
References
- RHSA-2023:5170 vendor-advisory
- RHSA-2023:5310 vendor-advisory
- RHSA-2023:5337 vendor-advisory
- RHSA-2023:5446 vendor-advisory
- RHSA-2023:5479 vendor-advisory
- RHSA-2023:5480 vendor-advisory
- RHSA-2023:6107 vendor-advisory
- RHSA-2023:6112 vendor-advisory
- RHSA-2023:7653 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-4853 vdb-entry
- RHSB-2023-002 technical-description
- RHBZ#2238034 issue-tracking