Bug 2148867 (CVE-2022-4147)

Summary:	CVE-2022-4147 quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anstephe, avibelli, bgeorges, chazlett, clement.escoffier, dandread, dkreling, gsmet, hamadhan, jwon, lthon, marcel, max.andersen, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Quarkus. The Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property, and have no ReadableStream object used in the request.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-14 07:18:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2148868

Description Sandipan Roy 2022-11-28 08:25:47 UTC

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Comment 2 marcel 2022-11-30 16:57:42 UTC

This is already fixed with 2.13.5 and 2.14.2. See https://quarkus.io/blog/quarkus-2-14-2-final-released/ and the discussion at https://quarkusio.zulipchat.com/#narrow/stream/187030-users/topic/CVE-2022-4147

Comment 3 errata-xmlrpc 2022-12-13 13:20:51 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus Platform 2.7.6.SP3

Via RHSA-2022:8957 https://access.redhat.com/errata/RHSA-2022:8957

Comment 4 Product Security DevOps Team 2022-12-14 07:18:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-4147

Comment 5 errata-xmlrpc 2022-12-14 13:15:32 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.13.5

Via RHSA-2022:9023 https://access.redhat.com/errata/RHSA-2022:9023