GHSA-mv64-86g8-cqq7

Suggest an improvement
Source
https://github.com/advisories/GHSA-mv64-86g8-cqq7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mv64-86g8-cqq7/GHSA-mv64-86g8-cqq7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mv64-86g8-cqq7
Aliases
Published
2024-04-25T18:30:39Z
Modified
2024-04-25T23:56:50Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Quarkus: security checks in resteasy reactive may trigger a denial of service
Details

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Database specific 
{
    "cwe_ids": [
        "CWE-281"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T23:34:44Z",
    "nvd_published_at": "2024-04-25T17:15:48Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven
io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.8.0.CR1
Fixed
3.8.0

Affected versions

3.*
3.8.0.CR1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mv64-86g8-cqq7/GHSA-mv64-86g8-cqq7.json"
io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3.0.CR1
Fixed
3.7.4

Affected versions

3.*
3.3.0.CR1
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0.CR1
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0.CR1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0.CR1
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.7.0.CR1
3.7.0
3.7.1
3.7.2
3.7.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mv64-86g8-cqq7/GHSA-mv64-86g8-cqq7.json"
io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.11.Final

Affected versions

1.*
1.11.0.Beta1
1.11.0.Beta2
1.11.0.CR1
1.11.0.Final
1.11.1.Final
1.11.2.Final
1.11.3.Final
1.11.4.Final
1.11.5.Final
1.11.6.Final
1.11.7.Final
1.12.0.CR1
1.12.0.Final
1.12.1.Final
1.12.2.Final
1.13.0.CR1
1.13.0.Final
1.13.1.Final
1.13.2.Final
1.13.3.Final
1.13.4.Final
1.13.5.Final
1.13.6.Final
1.13.7.Final
2.*
2.0.0.Alpha1
2.0.0.Alpha2
2.0.0.Alpha3
2.0.0.CR1
2.0.0.CR2
2.0.0.CR3
2.0.0.Final
2.0.1.Final
2.0.2.Final
2.0.3.Final
2.1.0.CR1
2.1.0.Final
2.1.1.Final
2.1.2.Final
2.1.3.Final
2.1.4.Final
2.2.0.CR1
2.2.0.Final
2.2.1.Final
2.2.2.Final
2.2.3.Final
2.2.4.Final
2.2.5.Final
2.3.0.CR1
2.3.0.Final
2.3.1.Final
2.4.0.CR1
2.4.0.Final
2.4.1.Final
2.4.2.Final
2.5.0.CR1
2.5.0.Final
2.5.1.Final
2.5.2.Final
2.5.3.Final
2.5.4.Final
2.6.0.CR1
2.6.0.Final
2.6.1.Final
2.6.2.Final
2.6.3.Final
2.7.0.CR1
2.7.0.Final
2.7.1.Final
2.7.2.Final
2.7.3.Final
2.7.4.Final
2.7.5.Final
2.7.6.Final
2.7.7.Final
2.8.0.CR1
2.8.0.Final
2.8.1.Final
2.8.2.Final
2.8.3.Final
2.9.0.CR1
2.9.0.Final
2.9.1.Final
2.9.2.Final
2.10.0.CR1
2.10.0.Final
2.10.1.Final
2.10.2.Final
2.10.3.Final
2.10.4.Final
2.11.0.CR1
2.11.0.Final
2.11.1.Final
2.11.2.Final
2.11.3.Final
2.12.0.CR1
2.12.0.Final
2.12.1.Final
2.12.2.Final
2.12.3.Final
2.13.0.CR1
2.13.0.Final
2.13.1.Final
2.13.2.Final
2.13.3.Final
2.13.4.Final
2.13.5.Final
2.13.6.Final
2.13.7.Final
2.13.8.Final
2.13.9.Final
2.14.0.CR1
2.14.0.Final
2.14.1.Final
2.14.2.Final
2.14.3.Final
2.15.0.CR1
2.15.0.Final
2.15.1.Final
2.15.2.Final
2.15.3.Final
2.16.0.CR1
2.16.0.Final
2.16.1.Final
2.16.2.Final
2.16.3.Final
2.16.4.Final
2.16.5.Final
2.16.6.Final
2.16.7.Final
2.16.8.Final
2.16.9.Final
2.16.10.Final
2.16.11.Final
2.16.12.Final
3.*
3.0.0.Alpha1
3.0.0.Alpha2
3.0.0.Alpha3
3.0.0.Alpha4
3.0.0.Alpha5
3.0.0.Alpha6
3.0.0.Beta1
3.0.0.CR1
3.0.0.CR2
3.0.0.Final
3.0.1.Final
3.0.2.Final
3.0.3.Final
3.0.4.Final
3.1.0.CR1
3.1.0.Final
3.1.1.Final
3.1.2.Final
3.1.3.Final
3.2.0.CR1
3.2.0.Final
3.2.1.Final
3.2.2.Final
3.2.3.Final
3.2.4.Final
3.2.5.Final
3.2.6.Final
3.2.7.Final
3.2.8.Final
3.2.9.Final
3.2.10.Final

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mv64-86g8-cqq7/GHSA-mv64-86g8-cqq7.json"