CVE-2023-2974 quarkus-core vulnerable to client driven TLS cipher downgrading
Attackers can force weaker TLS protocols in Quarkus applications, bypassing configured security settings and potentially exposing data to downgrade attacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2974?
CVE-2023-2974 is a medium-severity vulnerability in Red Hat build of Quarkus 2.13.8.Final, published on 4 Jul 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
Weakness: CWE-757
Which versions are affected by CVE-2023-2974?
2 open source packages ship an affected version, including io.quarkus:quarkus-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus:quarkus-core Maven | All versions | 2.16.8.Final |
io.quarkus:quarkus-core Maven | All versions | 2.16.8.Final |
Products include Redhat Build of Quarkus.
How do I fix CVE-2023-2974?
Upgrade io.quarkus:quarkus-core to 2.16.8.Final or later.
Is CVE-2023-2974 being exploited?
There is no known exploitation of CVE-2023-2974 in the wild and no public exploit code.
Other vulnerabilities in Red Hat build of Quarkus 2.13.8.Final
- CVE-2022-4492 Undertow client not checking server identity presented by server certificate in https connections
- CVE-2023-1664 Keycloak Untrusted Certificate Validation vulnerability
- CVE-2021-3914 SmallRye Health UI Cross-site Scripting vulnerability
- CVE-2023-6393 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
- CVE-2021-3536 Cross-site Scripting in Wildfly
Sources
Also known as GHSA-3fhx-3vvg-2j84.