Assorted JAX-RS security fixes - CVE-2023-6267 and CVE-2023-5675

[gsmet]

These fixes were written by @michalvavrik .

Fixes CVE-2023-6267
Fixes CVE-2023-5675

[michalvavrik]

I see the failures.

• The stacktrace for ElytronOauth2ExtensionResourceTestCase.testGrpcAuthorization is not helpful, this happens when you try to access RoutingContext but I can't see how injection in JAX-RS filter could cause that inside gRPC handler.
• SmallRye Token Propagation is about same issue

I'll need to debug it before I make any assumption. Maybe not today, hope it can wait for a day or so. Anyway, it looks like related to latest changes in gRPC security in 3.7, so I'd not worry about 3.2. I'll let you know.

[michalvavrik]

You probably get it from what I wrote, but without further digging I'd expect 3.6.x not to be affected by these failures (hope I got it right), so it shouldn't block you and I'll have time to look at it tomorrow and so on.

[gsmet]

@michalvavrik 3.7 is planned for Wednesday. If I can merge a fix by Tuesday evening, that's all fine.

[michalvavrik]

@gsmet 36bfe4c

[michalvavrik]

I do recommend to apply the fix on 3.6 branch just to be safe as well, though I'm currently not aware of concrete scenario where this could cause a problem.

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.