CVE-2023-2974

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

Published: Jul 4, 2023
Updated: May 10, 2024
CVE: CVE-2023-2974
GHSA: GHSA-3fhx-3vvg-2j84
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.1
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
io.quarkus / quarkus-core	-	2.16.8.Final
redhat / build_of_quarkus	-	2.13.8

https://access.redhat.com/errata/RHSA-2023:3809
https://access.redhat.com/security/cve/CVE-2023-2974
https://bugzilla.redhat.com/show_bug.cgi?id=2211026
https://github.com/quarkusio/quarkus/commit/468397ae53a8d6aae933d0d406f94965e97d1935
https://github.com/quarkusio/quarkus/pull/34469

Vulnerability Database

CVE-2023-2974

Deep Security Visibility Without the Complexity