← CVE Intelligence

CVE-2024-2700

Quarkus-core: leak of local configuration properties into quarkus applications PUBLISHED

Description (CNA)

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 3.8.4; affected 3.2.12
Red Hat / HawtIO 4.0.0 for Red Hat build of Apache Camel 4unaffected
Red Hat / Red Hat AMQ Streams 2.7.0unaffected
Red Hat / Red Hat build of Apicurio Registry 2.6.1 GAunaffected
Red Hat / Red Hat build of Quarkus 3.2.12.Finalunaffected 3.2.12.Final-redhat-00001 before *
Red Hat / Red Hat build of Quarkus 3.8.4.redhatunaffected 3.8.4.redhat-00002 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-6 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-4 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.12.0-4 before *
Red Hat / Red Hat build of Apache Camel 4 for Quarkus 3affected
Red Hat / Red Hat build of Apache Camel - HawtIO 4affected
Red Hat / Red Hat Build of Keycloakaffected
Red Hat / Red Hat build of OptaPlanner 8affected
Red Hat / Red Hat build of Quarkusaffected
Red Hat / Red Hat Integration Camel K 1affected
Red Hat / Red Hat Integration Camel Quarkus 2affected

CWE

CWE-526

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.