CVE-2023-6393: Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Other sources
A flaw was found under Quarkus Cache Runtime. When a request processing utilizes a Uni cached using @CacheResult, and if the cached Uni reuses the initial "completion" context, the processing switches to the context of the cached Uni instead of the request context. It can be a problem if the cached Uni context contains sensitive information. A malicious user could benefit from this as a POST request could possibly return the response that is meant for another user, having access to sensitive data.
https://github.com/quarkusio/quarkus/issues/37078
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/quarkusto a version that resolves this vulnerability.Fixed in 3.2.9. - Upgrade
Upgrade
redhat/quarkusto a version that resolves this vulnerability.Fixed in 2.13.9. - Upgrade
Upgrade
maven/io.quarkus:quarkus-cacheto a version that resolves this vulnerability.Fixed in 3.2.9.Final - Upgrade
Upgrade
maven/io.quarkus:quarkus-cacheto a version that resolves this vulnerability.Fixed in 3.5.2
Event History
Frequently Asked Questions
What is CVE-2023-6393?
CVE-2023-6393 is a vulnerability in the Quarkus Cache Runtime that allows for potential invalid reuse of context when @CacheResult on a Uni is used.
What is the severity of CVE-2023-6393?
CVE-2023-6393 has a severity rating of medium and a CVSS score of 5.3.
How does CVE-2023-6393 impact Quarkus Cache Runtime?
CVE-2023-6393 can cause request processing to switch to a cached Uni with reused initial context, leading to potential security issues.
Which versions of Quarkus Cache Runtime are affected by CVE-2023-6393?
Versions 3.2.0.CR1 to 3.2.9.Final and versions 3.3.0.CR1 to 3.5.2 of Quarkus Cache Runtime are affected by CVE-2023-6393.
How can I fix CVE-2023-6393?
To fix CVE-2023-6393, update the Quarkus Cache Runtime to version 3.2.9.Final or newer (if using versions 3.2.0.CR1 to 3.2.9.Final), or update to version 3.5.2 or newer (if using versions 3.3.0.CR1 to 3.5.2).