ghsa-3fhx-3vvg-2j84
Vulnerability from github
Published
2023-07-04 15:30
Modified
2023-07-06 15:32
Severity
Summary
quarkus-core vulnerable to client driven TLS cipher downgrading
Details
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.8.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-2974"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T15:32:02Z",
"nvd_published_at": "2023-07-04T14:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.",
"id": "GHSA-3fhx-3vvg-2j84",
"modified": "2023-07-06T15:32:02Z",
"published": "2023-07-04T15:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2974"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/pull/34469"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:3809"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-2974"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211026"
},
{
"type": "PACKAGE",
"url": "https://github.com/quarkusio/quarkus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "quarkus-core vulnerable to client driven TLS cipher downgrading"
}
Loading...