Headline
GHSA-f8h5-v2vg-46rr: quarkus-core leaks local environment variables from Quarkus namespace during application's build
A vulnerability was found in the quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application’s build. Thus, running the resulting application inherits the values captured at build time.
However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It leads to dangerous behavior if the application does not override these values.
This behavior only happens for configuration properties from the quarkus.* namespace. So, application-specific properties are not captured.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-2700
quarkus-core leaks local environment variables from Quarkus namespace during application’s build
High severity GitHub Reviewed Published Apr 4, 2024 to the GitHub Advisory Database • Updated Apr 4, 2024
Package
maven io.quarkus:quarkus-core (Maven)
Affected versions
<= 3.9.1
A vulnerability was found in the quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application’s build. Thus, running the resulting application inherits the values captured at build time.
However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It leads to dangerous behavior if the application does not override these values.
This behavior only happens for configuration properties from the quarkus.* namespace. So, application-specific properties are not captured.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-2700
- https://access.redhat.com/security/cve/CVE-2024-2700
- https://bugzilla.redhat.com/show_bug.cgi?id=2273281
Published to the GitHub Advisory Database
Apr 4, 2024
Related news
Red Hat Security Advisory 2024-2106-03 - An update is now available for Red Hat build of Quarkus.
Red Hat Security Advisory 2024-4028-03 - Red Hat OpenShift Serverless version 1.33.0 is now available.
Red Hat Security Advisory 2024-3527-03 - Red Hat AMQ Streams 2.7.0 is now available from the Red Hat Customer Portal. Issues addressed include buffer overflow, denial of service, integer overflow, memory leak, and resource exhaustion vulnerabilities.
Red Hat Security Advisory 2024-2705-03 - An update is now available for Red Hat build of Quarkus.