REDHAT-BUG-2345172: High severity Red Hat Quarkus vulnerability
The vulnerability in Quarkus REST arises when REST endpoints are implemented without a CDI scope and utilize field injection for request parameters. In such cases, a single instance of the endpoint class is shared across multiple concurrent requests, leading to the potential exchange of request parameters between these requests. This means that data such as HTTP headers, URI templates, cookies, and form values from one request can inadvertently be accessed by another, posing significant security risks.Affected applications should ensure proper scoping with @RequestScoped or avoid field injection for request parameters. The issue is fixed in version 3.18.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quarkus RESTto a version that resolves this vulnerability.Fixed in 3.18.2 - Configuration
Ensure REST endpoint implementations use proper CDI scoping (e.g., annotate the endpoint class with @RequestScoped) so a single endpoint instance is not shared across concurrent requests.
Quarkus REST endpoints (CDI scoping) @RequestScoped annotation / CDI scope for endpoint class = Use @RequestScoped (ensure proper CDI scoping for REST endpoint instances) - Configuration
Avoid field injection for request parameters in Quarkus REST endpoints to prevent request data (e.g., HTTP headers, URI templates, cookies, form values) from being accessed across requests.
Quarkus REST endpoints (request parameter injection) Request parameter injection method = Avoid field injection; do not use field injection for request parameters
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2345172?
The severity of REDHAT-BUG-2345172 is critical due to the potential for data leakage between concurrent requests.
How do I fix REDHAT-BUG-2345172?
To fix REDHAT-BUG-2345172, ensure that REST endpoints in Quarkus are implemented with the correct CDI scopes and avoid using field injection for request parameters.
What versions of Red Hat Quarkus are affected by REDHAT-BUG-2345172?
REDHAT-BUG-2345172 affects all versions of Red Hat Quarkus up to, but not including, version 3.18.2.
What is the impact of not addressing REDHAT-BUG-2345172?
If REDHAT-BUG-2345172 is not addressed, it can lead to unintended sharing of request parameters across multiple users, compromising security.
Is there a workaround for REDHAT-BUG-2345172?
While a permanent fix is recommended, a workaround for REDHAT-BUG-2345172 is to avoid field injection in REST endpoints and use method parameters instead.