CVE-2023-2974
Redhat Build Of Quarkus ≤ 2.13.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-2974 is a medium-severity Algorithm Downgrade (CWE-757) vulnerability in Redhat Build Of Quarkus. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1937
Vulnerability Data
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
V12.1.1V12.2.1V12.3.3V17.2.2
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-04 addresses protection/verification of identity assertions in SSO/federation contexts while CWE-757 concerns protocol-level crypto algorithm negotiation, so the control neither prevents nor meaningfully mitigates the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.24 requires selecting strong approved algorithms per policy and classification (b,f), which can stop downgrade by mandating only-strong options; but the weakness lives in the negotiation protocol/implementation itself, and the clause does not reach or alter that design, leaving a bounded remainder (e.g. protocol-level downgrade attacks even with approved ciphers).
Secure SDLC practices include selecting strong crypto algorithms during design and implementation.
Application security requirements can specify minimum cryptographic strength to avoid downgrades.
A.8.27 mandates security-by-design principles (including least functionality, assume-breach, distrust-external-input, and selection of strong cryptography) plus design reviews against known attack patterns; this reaches the subset of algorithm-downgrade flaws that arise from missing or misapplied protocol-level choices, but leaves the dominant implementation-time and negotiation-logic cases (e.g. library defaults, missing minimum-strength enforcement) untouched.
Secure coding standards can mandate checks to reject weaker negotiated algorithms.
Security testing can detect and block algorithm downgrade vulnerabilities before deployment.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220938 The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. blocks CWE-757
Windows Server 2016 (1 rule)
- V-225054 The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM. blocks CWE-757
Windows Server 2019 (1 rule)
- V-205919 Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. blocks CWE-757