Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zZmh4LTN2dmctMmo4NM4AA0NF

quarkus-core vulnerable to client driven TLS cipher downgrading

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

Permalink: https://github.com/advisories/GHSA-3fhx-3vvg-2j84
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZmh4LTN2dmctMmo4NM4AA0NF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 10 months ago
Updated: 6 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-3fhx-3vvg-2j84, CVE-2023-2974
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-2974
• https://access.redhat.com/errata/RHSA-2023:3809
• https://access.redhat.com/security/cve/CVE-2023-2974
• https://bugzilla.redhat.com/show_bug.cgi?id=2211026
• https://github.com/quarkusio/quarkus/pull/34469
• https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935
• https://github.com/advisories/GHSA-3fhx-3vvg-2j84

Repository: https://github.com/quarkusio/quarkus
Blast Radius: 17.6

Affected Packages