GitHub Advisoryadvisory · Maven
GHSA-6hc9-cf8x-hf83 Quarkus OIDC can leak both ID and access tokens
HIGH
Official page ↗
- Aliases
- CVE-2023-1584
- Ecosystem
- Maven
- Packages
- io.quarkus:quarkus-oidc
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-10-04
Affected packages
• Maven io.quarkus:quarkus-oidc: < 2.13.0.Final → fixed in 2.13.0.Final
• Maven io.quarkus:quarkus-oidc: >= 3.0.0, < 3.1.0.Final → fixed in 3.1.0.Final
Description
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.
Related
Alias · CVE (1)
- CVE-2023-1584 A flaw was found in Quarkus. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-1584 advisory
- https://github.com/quarkusio/quarkus/pull/32192 web
- https://github.com/quarkusio/quarkus/pull/32192/commits/5369d7ff233d3afe84ecd9160c541fba52b38e69 web
- https://github.com/quarkusio/quarkus/pull/33414 web
- https://github.com/quarkusio/quarkus/pull/33414/commits/df305ff12386cf28b33567b8d9a18db164f019dd web
- https://github.com/quarkusio/quarkus/commit/5369d7ff233d3afe84ecd9160c541fba52b38e69 web
- https://github.com/quarkusio/quarkus/commit/df305ff12386cf28b33567b8d9a18db164f019dd web
- https://access.redhat.com/errata/RHSA-2023:3809 web
- https://access.redhat.com/errata/RHSA-2023:7653 web
- https://access.redhat.com/security/cve/CVE-2023-1584 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2180886 web
- https://github.com/quarkusio/quarkus package