| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| io.quarkus:quarkus-csrf-reactive | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-keycloak-authorization | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-undertow | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| io.quarkus:quarkus-vertx-http | ≥ 3.0.0, < 3.2.6.Final≥ 3.3.0, < 3.3.3< 2.16.11.Final | 3.2.6.Final3.3.32.16.11.Final |
| quarkus | ≥ 3.2.0, < 3.2.6≥ 3.3.0, < 3.3.3< 2.16.11 | 3.2.63.3.32.16.11 |
| build of optaplanner | = 8.0 | |
| build of quarkus | ≥ 2.13.0, < 2.13.8 | 2.13.8 |
| decision manager | = 7.0 | |
| integration camel k | < 1.10.2 | 1.10.2 |
| jboss middleware | = 1 | |
| jboss middleware text-only advisories | = 1.0 | |
| openshift container platform | = 4.10= 4.11= 4.12 | |
| openshift serverless | = 1.0 | |
| process automation manager | = 7.0 |
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン