CVE-2023-4853highCWE-148

CVE-2023-4853: high-severity vulnerability in Red Hat Openshift Serverless 1 on RHEL 8

Quarkus: http security policy bypass

Published · Updated

Follow this CVE+ Monitor Red Hat Process Automation+ Monitor RHEL-8 based Middleware Containers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 2.3%
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Red Hat · Openshift Serverless 1 on RHEL 8Red Hat · Red Hat build of OptaPlanner 8Red Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 2.13.8.SP2Red Hat · Red Hat Camel Extensions for Quarkus 2.13.3-1Red Hat · Red Hat Integration Camel Quarkus 2Red Hat · Red Hat OpenShift Serverless 1.30Red Hat · Red Hat Process Automation 7Red Hat · RHEL-8 based Middleware ContainersRed Hat · RHINT Camel-K-1.10.2Red Hat · RHINT Service Registry 2.5.4 GARed Hat · RHPAM 7.13.4 async
Related CVEs — Red Hat Openshift Serverless 1 on RHEL 8

In the same product, most dangerous first.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2023-1108HIGHUndertow: infinite loop in sslconduit during closeEPSS 1.8%