CVE-2023-2974

CWE-7575 documents5 sources
Severity
8.1HIGH
EPSS
0.5%
top 36.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Build OF Quarkus
Timeline
PublishedJul 4

Description

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages2 packages

▶Mavenio.quarkus:quarkus-core< 2.16.8.Final

🔴Vulnerability Details

3
CVEList
Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol↗2023-07-04
▶
OSV
quarkus-core vulnerable to client driven TLS cipher downgrading↗2023-07-04
▶
GHSA
quarkus-core vulnerable to client driven TLS cipher downgrading↗2023-07-04
▶

📋Vendor Advisories

1
Red Hat
quarkus-core: TLS protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported TLS protocol↗2023-06-29
▶
CVE-2023-2974 (HIGH CVSS 8.1) | A vulnerability was found in quarku | cvebase.io