Red Hat build of Quarkus 2.13.8.Final vulnerabilities

2 known vulnerabilities in Red Hat build of Quarkus 2.13.8.Final from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Red Hat build of Quarkus 2.13.8.Final: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-1584Oct 4, 2023Red Hat

  A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token

• 8.1 High severity

  Red Hat build of Quarkus 2.13.8.Final: Selection of Less-Secure Algorithm During Negotiation

  CVE-2023-2974Jul 4, 2023Red Hat

  A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.