CVE-2023-2974: redhat build_of_quarkus Algorithm Downgrade

Vulnerability summary

CVE-2023-2974 is a high (CVSS 8.1) Algorithm Downgrade vulnerability in redhat build_of_quarkus. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities.

Timeline

1. 04-07-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

• CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.