title: Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
description: A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
problem types: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: quarkus
vendor: n/a
versions:
version: 3.2.9.GA, status: unaffected
version: 2.13.9.CR2, status: unaffected
}
{
product: upstream
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-cache
defaultStatus: affected
cpes: cpe:/a:redhat:quarkus:2
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: No mitigation is currently available for this flaw.