Homepage

io.quarkus:quarkus-security-deployment@3.6.1 vulnerabilities

  • latest version

    3.17.4

  • latest non vulnerable version

    3.17.4

  • first published

    5 years ago

  • latest version published

    11 days ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.quarkus:quarkus-security-deployment package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Authorization

    io.quarkus:quarkus-security-deployment is a Quarkus Security Deployment

    Affected versions of this package are vulnerable to Improper Authorization due to improper enforcement of authorization checks in JAX-RS endpoints that are either declared in abstract Java classes or customized by Quarkus extensions using the annotation processor. An attacker can bypass access restrictions by exploiting the lack of authorization on these endpoints.

    Note:

    A combination of 2 factors triggers it:

    1. Users enable the security authorization of JAX-RS endpoints with either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or quarkus.security.jaxrs.default-roles-allowed properties.

    2. Users declare JAX-RS methods which must be secured with these properties in the Java abstract class which the JAX-RS endpoint class will extend

    How to fix Improper Authorization?

    Upgrade io.quarkus:quarkus-security-deployment to version 3.2.10.Final, 3.6.8, 3.7.1 or higher.

    [0,3.2.10.Final)[3.3.0.CR1,3.6.8)[3.7.0.CR1,3.7.1)
    Go back to all versions of this package