Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2024-2700

Quarkus-core: leak of local configuration properties into quarkus applications

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

quarkus-core

Default version status: unaffected

  • 3.8.4affected
  • 3.2.12affected

Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4

Default version status: unaffected

Red Hat Red Hat AMQ Streams 2.7.0

Default version status: unaffected

Red Hat Red Hat build of Apicurio Registry 2.6.1 GA

Default version status: unaffected

Red Hat Red Hat build of Quarkus 3.2.12.Final

Default version status: affected

  • 3.2.12.Final-redhat-00001 to < *unaffected

Red Hat Red Hat build of Quarkus 3.8.4.redhat

Default version status: affected

  • 3.8.4.redhat-00002 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-5 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-5 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-6 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-5 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.33.0-4 to < *unaffected

Red Hat RHOSS-1.33-RHEL-8

Default version status: affected

  • 1.12.0-4 to < *unaffected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apache Camel - HawtIO 4

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat build of OptaPlanner 8

Default version status: affected

Red Hat Red Hat build of Quarkus

Default version status: affected

Red Hat Red Hat Integration Camel K 1

Default version status: affected

Red Hat Red Hat Integration Camel Quarkus 2

Default version status: affected

References