CVE-2024-2700
Quarkus-core: leak of local configuration properties into quarkus applications
Reported by redhat · Published April 4, 2024
A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 3.8.4, 3.2.12 | ||
| Red Hat | HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | |
| Red Hat | Red Hat AMQ Streams 2.7.0 | |
| Red Hat | Red Hat build of Apicurio Registry 2.6.1 GA | |
| Red Hat | Red Hat build of Quarkus 3.2.12.Final | 3.2.12.Final-redhat-00001 |
| Red Hat | Red Hat build of Quarkus 3.8.4.redhat | 3.8.4.redhat-00002 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-4 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
| Red Hat | RHOSS-1.33-RHEL-8 | 1.12.0-6 |
…and 82 more
Timeline
- Apr 4, 2024 CVE Published
- Apr 5, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (9 in total, the first dated here)
- Jan 15, 2026 CVE Updated
- Mar 17, 2026 Security Advisory (23 in total, the first dated here)
- Apr 29, 2026 Distribution Patch (21 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-2700
vulnetix vdb fixes CVE-2024-2700Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-2700/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- RHSA-2024:11023 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:2106 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:2705 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:3527 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:4028 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:4873 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2273281 issue-trackingx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2024-2700 advisory
- https://github.com/advisories/GHSA-f8h5-v2vg-46rr advisory
- https://github.com/quarkusio/quarkus/issues/39927 url
- https://github.com/quarkusio/quarkus/commit/2b24dc8dbc8f390c97428783d67614418676fc2e patch
- https://github.com/quarkusio/quarkus/commit/91c3a58eaefe59e0afd430653d1636d664bd593f patch
- https://github.com/quarkusio/quarkus/commit/990c3ee5dd5c689f514e5e87c221bce6d5dff267 patch
- https://github.com/quarkusio/quarkus url
- https://quarkus.io/blog/quarkus-3-2-12-final-released url
- https://quarkus.io/blog/quarkus-3-8-4-released url