Description
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Quarkus | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.quarkus:quarkus-cache | >= 3.3.0.CR1, < 3.5.2 | 3.5.2 | GHSA-xfv5-jqgp-vqhj |
| Maven | io.quarkus:quarkus-cache | >= 3.2.0.CR1, < 3.2.9.Final | 3.2.9.Final | GHSA-xfv5-jqgp-vqhj |
References
- RHSA-2023:7700 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6393 vdb-entry
- RHBZ#2253113 issue-tracking