io.quarkus:quarkus-security-deployment@1.0.0.CR2 vulnerabilities
latest version
3.17.4
latest non vulnerable version
first published
5 years ago
latest version published
12 days ago
licenses detected
- [0.24.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the io.quarkus:quarkus-security-deployment package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
io.quarkus:quarkus-security-deployment is a Quarkus Security Deployment Affected versions of this package are vulnerable to Improper Authentication via the deserialization process of JSON payloads. An attacker can potentially compromise data integrity and confidentiality, and achieve high-severity impacts on availability by sending specially crafted JSON data that gets processed before security constraints are evaluated and applied. Note: This does not happen with configuration based security. Then security constraints are being evaluated/applied before a JSON body is being processed. How to fix Improper Authentication? Upgrade | [0,3.2.10.Final) |
io.quarkus:quarkus-security-deployment is a Quarkus Security Deployment Affected versions of this package are vulnerable to Improper Authorization due to improper enforcement of authorization checks in JAX-RS endpoints that are either declared in abstract Java classes or customized by Quarkus extensions using the annotation processor. An attacker can bypass access restrictions by exploiting the lack of authorization on these endpoints. Note: A combination of 2 factors triggers it:
How to fix Improper Authorization? Upgrade | [0,3.2.10.Final)[3.3.0.CR1,3.6.8)[3.7.0.CR1,3.7.1) |