CVE-2023-6393
Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
Reported by redhat · Published December 6, 2023
quarkus-cache is fixed in 3.5.2, 3.2.9.Final and 3.2.9 (Maven Central)
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| io.quarkus:quarkus-cache | Maven Central | 3.5.2, 3.2.9.Final, 3.2.9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Quarkus | |
| Red Hat | Red Hat build of Quarkus 2.13.9.Final | 2.13.9.Final-redhat-00002 |
| Red Hat | Red Hat build of Quarkus | |
| Maven | io.quarkus:quarkus-cache | 3.2.0.CR1, 3.3.0.CR1 |
| Red Hat | Red Hat build of Quarkus |
Timeline
- Dec 6, 2023 CVE Published
- Dec 7, 2023 EPSS Score (30 in total, the first dated here)
- Dec 30, 2023 PoC Published
- Oct 5, 2024 Coalition ESS Score (6 in total, the first dated here)
- May 31, 2026 Distribution Patch
- May 31, 2026 Security Advisory (2 in total, the first dated here)
- Sep 29, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-6393
vulnetix vdb fixes CVE-2023-6393Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-6393/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- RHSA-2023:7700 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2253113 issue-trackingx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2023-6393 advisory
- https://github.com/quarkusio/quarkus/issues/37078 url
- https://github.com/quarkusio/quarkus/pull/37077 patch
- https://github.com/quarkusio/quarkus/commit/d9ace85caec2d8497b1a2c48b8d52bb163f04adf patch
- https://github.com/advisories/GHSA-xfv5-jqgp-vqhj advisory