Skip to content
Fencer Vulns
high 7.0

CVE-2024-2700 json

Quarkus-core: leak of local configuration properties into quarkus applications

published 2024-04-04 2 y ago modified 2026-11-05 4 d ago also GHSA-f8h5-v2vg-46rr , EUVD-2024-1194

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.

Patch / fix

  • maven io.quarkus:quarkus-core 3.2.12.Final, 3.8.4, 3.9.2
  • Red Hat Red Hat build of Quarkus 3.2.12.Final 3.2.12.Final-redhat-00001
  • Red Hat Red Hat build of Quarkus 3.8.4.redhat 3.8.4.redhat-00002
  • Red Hat RHOSS-1.33-RHEL-8 1.12.0-4, 1.12.0-6, 1.33.0-4, 1.33.0-5, 1.33.0-6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-2700 updated cvss 7.0

quarkus-core: Leak of local configuration properties into Quarkus applications

  • Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-core Red Hat Build of Keycloak quarkus-core
    affected: workaround, no fix available “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.”
  • Red Hat build of OptaPlanner 8 quarkus-core Red Hat build of Quarkus quarkus-core Red Hat Integration Camel K 1 quarkus-core Red Hat Integration Camel Quarkus 2 quarkus-core
    affected: workaround, no fix planned “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.”
  • Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:11023
  • Red Hat AMQ Streams 2.7.0
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:3527
  • Red Hat build of Apicurio Registry 2.6.1 GA
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:4873
  • Red Hat build of Quarkus 3.2.12.Final quarkus-core 3.2.12.Final-redhat-00001
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:2705
  • Red Hat build of Quarkus 3.8.4.redhat quarkus-core 3.8.4.redhat-00002
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:2106
  • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/client-kn-rhel8 1.12.0-4, openshift-serverless-1/func-utils-rhel8 1.33.0-4, openshift-serverless-1/serving-queue-rhel8 1.12.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.12.0-6, openshift-serverless-1/kourier-control-rhel8 1.12.0-4, openshift-serverless-1/serving-webhook-rhel8 1.12.0-4, +30 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability. Please update as the patches become available.” RHSA-2024:4028
show 1 more
  • Red Hat build of Quarkus 3.2.12.Final jna 5.8.0, lit 2.7.4, bson 4.9.1, db2 1.18.3, h2 2.2.220, jdom 1.1.3, +1046 more Red Hat build of Quarkus 3.8.4.redhat jna 5.8.0, lit 3.1.2, db2 1.19.6, h2 2.2.224, okio 3.6.0, y18n 5.0.8, +1011 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven io.quarkus:quarkus-core
>=3.9.0.CR1, <3.9.2
>=3.3.0.CR1, <3.8.4
<3.2.12.Final
3.9.2
3.8.4
3.2.12.Final

Affected products

  • Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4
  • Red Hat Red Hat AMQ Streams 2.7.0
  • Red Hat Red Hat build of Apicurio Registry 2.6.1 GA
  • Red Hat Red Hat build of Quarkus 3.2.12.Final
  • Red Hat Red Hat build of Quarkus 3.8.4.redhat
  • Red Hat RHOSS-1.33-RHEL-8
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat Integration Camel Quarkus 2

Classification

Weakness
  • CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.