| Package | Affected versions | Patched versions |
|---|---|---|
| io.quarkus:quarkus-csrf-reactive | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-keycloak-authorization | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-undertow | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-vertx-http | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| quarkus | ≥ 3.2.0, < 3.2.6≥ 3.3.0, < 3.3.3< 2.16.11 | 3.2.63.3.32.16.11 |
| build of optaplanner | = 8.0 | |
| build of quarkus | ≥ 2.13.0, < 2.13.8 | 2.13.8 |
| decision manager | = 7.0 | |
| integration camel k | < 1.10.2 | 1.10.2 |
| jboss middleware | = 1 | |
| jboss middleware text-only advisories | = 1.0 | |
| openshift container platform | = 4.10= 4.11= 4.12 | |
| openshift serverless | = 1.0 | |
| process automation manager | = 7.0 |
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free