REDHAT-BUG-2265158
First published: Tue Feb 20 2024(Updated: )
Description: Security checks for standard security annotations on the RESTEasy Reactive inherited endpoints are not performed eagerly, but are performed by standard security interceptors instead. Apart from functional differences it also means security checks for inherited endpoints are not performed eagerly. As long as you know any POST / PUT / PATCH request paths, you can send unauthenticated HTTP requests with illegal payload and see response status. When you get 500 ... this way you detect endpoints (though there can be other reasons...) Can you significantly raise processing time? You can send valid content which means requests will be stopped after JAX-RS filters. Resulting impact depends on what they do in JAX-RS filters. Affected Quarkus version: 999-SNAPSHOT, 3.8.x. 3.7.x, 3.2.x, 2.13.x Mitigations with affected version: Don't use inherited endpoints (or use HTTP permissions, depending on the scenario) References: <a href="https://github.com/quarkusio/quarkus/pull/38832">https://github.com/quarkusio/quarkus/pull/38832</a> <a href="https://github.com/quarkusio/quarkus/issues/38754">https://github.com/quarkusio/quarkus/issues/38754</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Quarkus RESTEasy | >3.8.0<=3.8.x>3.7.0<=3.7.x>3.2.0<=3.2.x>2.13.0<=2.13.x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2265158?
The severity of REDHAT-BUG-2265158 relates to improper security checks in inherited endpoints in RESTEasy Reactive, which could lead to security vulnerabilities.
How do I fix REDHAT-BUG-2265158?
To fix REDHAT-BUG-2265158, upgrade to a patched version of Red Hat Quarkus that addresses the security check issue.
What versions of Red Hat Quarkus are affected by REDHAT-BUG-2265158?
Red Hat Quarkus versions from 2.13.0 to 3.8.x are affected by REDHAT-BUG-2265158.
What are the functional implications of REDHAT-BUG-2265158?
The functional implication of REDHAT-BUG-2265158 is that inherited endpoints may not have security checks performed as expected, increasing the risk of unauthorized access.
Are there any recommended practices to mitigate the risk of REDHAT-BUG-2265158?
Recommended practices to mitigate the risk of REDHAT-BUG-2265158 include conducting regular security audits and ensuring the application is updated to the latest secure versions.
- agent/severity
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-1726
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat quarkus resteasy