REDHAT-BUG-2457819: High severity Red Hat Quarkus vulnerability
Quarkus is vulnerable to an authorization bypass issue where semicolons (matrix parameters) in HTTP requests can be used to bypass path-based HTTP security policies. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters.
When a path such as "/api/admin" is protected by a path-based HTTP security policy, sending a request like "/api/admin;anything" can bypass this policy while still routing to the protected endpoint unless the policy is configured to protect the exact "/api/admin;anything" path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457819?
The severity of REDHAT-BUG-2457819 is classified as high with a score of 7.
What is the description of REDHAT-BUG-2457819?
REDHAT-BUG-2457819 describes a vulnerability in Quarkus that allows an authorization bypass through matrix parameters in HTTP requests.
How do I fix REDHAT-BUG-2457819?
To fix REDHAT-BUG-2457819, ensure that your version of Red Hat Quarkus is updated to the latest patched release.
Is the authorization bypass in REDHAT-BUG-2457819 critical?
Yes, the authorization bypass in REDHAT-BUG-2457819 is considered a significant security risk that could compromise application integrity.
Which software is affected by REDHAT-BUG-2457819?
REDHAT-BUG-2457819 affects the Red Hat Quarkus software.