quarkusio/quarkus · Security
quarkus-core vulnerable to client driven TLS cipher downgrading
- GHSA ID
- GHSA-3fhx-3vvg-2j84
- CVE ID
- CVE-2023-2974
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Description
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-2974 ↗
- https://access.redhat.com/errata/RHSA-2023:3809 ↗
- https://access.redhat.com/security/cve/CVE-2023-2974 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2211026 ↗
- https://github.com/quarkusio/quarkus/pull/34469 ↗
- https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935 ↗
- https://github.com/advisories/GHSA-3fhx-3vvg-2j84 ↗