Description
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Quarkus quarkus-qute
Default version status: unaffected
3.27.0 to < 3.27.5.SP1affected3.33.0 to < 3.33.3.SP1affected
Red Hat Red Hat Build of Apache Camel 3.33.3.SP1
Default version status: affected
3.33.3.redhat-00005 to < *unaffected
Red Hat Red Hat build of Quarkus 3.27.5.SP1
Default version status: affected
3.27.5.redhat-00004 to < *unaffected
Red Hat Red Hat build of Quarkus 3.33.3.SP1
Default version status: affected
3.33.3.redhat-00005 to < *unaffected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Default version status: unaffected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Default version status: unaffected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Default version status: unaffected
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Default version status: unaffected
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Default version status: unaffected