Red Hat Security Advisory: Red Hat Integration Camel K 1.10.2 release security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2023-4853 — quarkus: HTTP security policy bypass
🎯 Affected products1
- RHINT Camel-K-1.10.2
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Use a ‘deny’ wildcard for base paths, then authenticate specifics within that: Examples: ``` deny: /* authenticated: /services/* ``` or ``` deny: /services/* roles-allowed: /services/rbac/* ``` NOTE: Products are only vulnerable if they use (or allow use of) path-based HTTP policy configuration. Products may also be affected–shipping the component in question–without being vulnerable (“affected at reduced impact”). See https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 for more detailed mitigations.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2023:5337
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-002
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q3
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2238034
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5337.json