Cleartext transmission of sensitive information in Quarkus - CVE-2023-1584

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used. A remote attacker  can gain access to potentially sensitive information.

Affected software

How to mitigate CVE-2023-1584

External References

• https://github.com/quarkusio/quarkus/pull/32192
• https://access.redhat.com/security/cve/CVE-2023-1584
• https://access.redhat.com/errata/RHSA-2023:3809
• https://bugzilla.redhat.com/show_bug.cgi?id=2180886
• https://github.com/quarkusio/quarkus/pull/33414

Related Security Bulletins

• Information disclosure in Quarkus OIDC
• Multiple vulnerabilities in Red Hat Integration - Service Registry 2.5