CVE-2023-2974CWE-757

Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol

Medium · published July 4, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00882 · 58.8th percentile
Weakness
CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2023-07-04T13:24Z
EPSS history
Timeline
  • 04 JUL 13:24Z
    Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol
    cvelistv5