GitHub Advisoryadvisory · Maven
GHSA-3fhx-3vvg-2j84 quarkus-core vulnerable to client driven TLS cipher downgrading
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2974
- Ecosystem
- Maven
- Packages
- io.quarkus:quarkus-core
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Reviewed
- 2023-07-06
Affected packages
• Maven io.quarkus:quarkus-core: < 2.16.8.Final → fixed in 2.16.8.Final
Description
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
Related
Alias · CVE (1)
- CVE-2023-2974 A vulnerability was found in quarkus-core. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-2974 advisory
- https://github.com/quarkusio/quarkus/pull/34469 web
- https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935 web
- https://access.redhat.com/errata/RHSA-2023:3809 web
- https://access.redhat.com/security/cve/CVE-2023-2974 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2211026 web
- https://github.com/quarkusio/quarkus package