Quarkus-core: leak of local configuration properties into quarkus applications
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.9.2, 3.8.4, 3.2.12.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- quarkus-core
3.8.4, 3.2.12
- quarkus-core
Version range not reported
- Red Hat Red Hat AMQ Streams 2.7.0
Version range not reported
- quarkus-core
Version range not reported
- io.quarkus/quarkus-core
Version range not reported
- io.quarkus/quarkus-core
Version range not reported
- openshift-serverless-1/client-kn-rhel8
Version range not reported
- openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8
Version range not reported
- openshift-serverless-1/eventing-controller-rhel8
Version range not reported
- openshift-serverless-1/eventing-in-memory-channel-controller-rhel8
Version range not reported
- openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8
Version range not reported
- openshift-serverless-1/eventing-istio-controller-rhel8
Version range not reported
- openshift-serverless-1/eventing-kafka-broker-controller-rhel8
Version range not reported
- openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8
Version range not reported
- openshift-serverless-1/eventing-kafka-broker-post-install-rhel8
Version range not reported
- openshift-serverless-1/eventing-kafka-broker-receiver-rhel8
Version range not reported
- openshift-serverless-1/eventing-kafka-broker-webhook-rhel8
Version range not reported
- openshift-serverless-1/eventing-mtbroker-filter-rhel8
Version range not reported
- openshift-serverless-1/eventing-mtbroker-ingress-rhel8
Version range not reported
- openshift-serverless-1/eventing-mtchannel-broker-rhel8
Version range not reported
- openshift-serverless-1/eventing-mtping-rhel8
Version range not reported
- openshift-serverless-1/eventing-storage-version-migration-rhel8
Version range not reported
- openshift-serverless-1/eventing-webhook-rhel8
Version range not reported
- openshift-serverless-1/func-utils-rhel8
Version range not reported
- openshift-serverless-1/ingress-rhel8-operator
Version range not reported
- openshift-serverless-1/knative-rhel8-operator
Version range not reported
- openshift-serverless-1/kn-cli-artifacts-rhel8
Version range not reported
- openshift-serverless-1/kourier-control-rhel8
Version range not reported
- openshift-serverless-1/net-istio-controller-rhel8
Version range not reported
- openshift-serverless-1/net-istio-webhook-rhel8
Version range not reported
- openshift-serverless-1/serverless-operator-bundle
Version range not reported
- openshift-serverless-1/serverless-rhel8-operator
Version range not reported
- openshift-serverless-1/serving-activator-rhel8
Version range not reported
- openshift-serverless-1/serving-autoscaler-hpa-rhel8
Version range not reported
- openshift-serverless-1/serving-autoscaler-rhel8
Version range not reported
- openshift-serverless-1/serving-controller-rhel8
Version range not reported
- openshift-serverless-1/serving-queue-rhel8
Version range not reported
- openshift-serverless-1/serving-storage-version-migration-rhel8
Version range not reported
- openshift-serverless-1/serving-webhook-rhel8
Version range not reported
- openshift-serverless-1/svls-must-gather-rhel8
Version range not reported
- openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8
Version range not reported
- openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- quarkus-core
Version range not reported
- io.quarkus:quarkus-coreMaven
From 3.9.0.CR1 · fixed in 3.9.2
- io.quarkus:quarkus-coreMaven
From 3.3.0.CR1 · fixed in 3.8.4
- io.quarkus:quarkus-coreMaven
fixed in 3.2.12.Final