CVE-2023-2974

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
Algorithm Downgrade
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
redhatCNA
6.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
VendorProductVersion
redhatbuild_of_quarkus
𝑥
< 2.13.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2023:3809
https://access.redhat.com/security/cve/CVE-2023-2974
https://bugzilla.redhat.com/show_bug.cgi?id=2211026
https://access.redhat.com/errata/RHSA-2023:3809
https://access.redhat.com/security/cve/CVE-2023-2974
https://bugzilla.redhat.com/show_bug.cgi?id=2211026