Bug 2062520 (CVE-2022-0981)

Summary:	CVE-2022-0981 quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus
Product:	[Other] Security Response	Reporter:	Ted Jongseok Won <jwon>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, avibelli, bgeorges, bibryam, chazlett, clement.escoffier, dandread, dkreling, drieden, eric.wittmann, gsmet, hamadhan, hbraun, janstey, jnethert, jochrist, jwon, krathod, lthon, mszynkie, pantinor, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	quarkus 2.7.1.Final	Doc Type:	---
Doc Text:	A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-18 15:02:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2051755, 2064168

Description Ted Jongseok Won 2022-03-10 04:04:17 UTC

A flaw was found in Quarkus in versions prior to 2.7.1.Final. State and potentially associated permissions can leak from one web request to another in RestEasy Reactive, leading to the possibility of a low-privileged user to be able to perform operations on the database with a different set of privileges than intended.

Upstream commit: https://github.com/quarkusio/quarkus/pull/23397

Comment 4 errata-xmlrpc 2022-05-18 10:56:40 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.7.5

Via RHSA-2022:4623 https://access.redhat.com/errata/RHSA-2022:4623

Comment 5 Product Security DevOps Team 2022-05-18 15:02:20 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0981

Comment 6 errata-xmlrpc 2022-07-19 13:40:35 UTC

This issue has been addressed in the following products:

  RHINT Camel-Q 2.7

Via RHSA-2022:5606 https://access.redhat.com/errata/RHSA-2022:5606

Comment 7 errata-xmlrpc 2022-10-06 12:27:26 UTC

This issue has been addressed in the following products:

  RHINT Service Registry 2.3.0 GA

Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835