PT-2023-3549 · Unknown · Quarkus-Core

Alexander Schwartz + 1 · Published 2023-05-30 · Updated 2023-07-11 · CVE-2023-2974

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions quarkus-core (affected versions not specified)

Description A vulnerability was found in the implementation of the TLS protocol in the Quarkus Java framework. This issue is related to the insufficient reliability of encryption when using the quarkus.http.ssl.protocols configuration. The vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, allowing a client to force the selection of a weaker supported TLS protocol. This could potentially allow a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-757

CWE-326

Related Identifiers

BDU:2023-03765

CVE-2023-2974

GHSA-3FHX-3VVG-2J84

Affected Products

Quarkus-Core

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-2974 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2211026 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2974 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03765 · Security Note
• https://osv.dev/vulnerability/GHSA-3fhx-3vvg-2j84 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-2974 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3809 · Vendor Advisory
• https://github.com/quarkusio/quarkus · Note
• https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935 · Note
• https://github.com/quarkusio/quarkus/pull/34469 · Note
• https://t.me/cvenotify/53649 · Telegram Post
• https://vuldb.com/ru/?id.232671 · Note
• https://access.redhat.com/security/cve/cve-2023-2974 · Note
• https://t.me/cvenotify/54068 · Telegram Post