REDHAT-BUG-2273281
First published: Thu Apr 04 2024(Updated: )
A vulnerability was found in quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application's build. Thus, running the resulting application inherits the values captured at build time. However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It leads to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. So, application-specific properties are not captured.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Quarkus |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:2106
- https://access.redhat.com/errata/RHSA-2024:2705
- https://access.redhat.com/errata/RHSA-2024:3527
- https://access.redhat.com/errata/RHSA-2024:4028
- https://access.redhat.com/errata/RHSA-2024:4873
- https://access.redhat.com/errata/RHSA-2024:11023
- https://bugzilla.redhat.com/show_bug.cgi?id=2273281
Frequently Asked Questions
What is the severity of REDHAT-BUG-2273281?
The severity of REDHAT-BUG-2273281 is high due to the potential exposure of sensitive local environment variables.
How do I fix REDHAT-BUG-2273281?
Fixing REDHAT-BUG-2273281 involves updating to the latest patched version of the Quarkus software.
What components are affected by REDHAT-BUG-2273281?
REDHAT-BUG-2273281 primarily affects the quarkus-core component of the Red Hat Build of Quarkus.
What is the impact of REDHAT-BUG-2273281?
The impact of REDHAT-BUG-2273281 is that it can lead to unintended exposure of environment variables, which may contain sensitive information.
When was REDHAT-BUG-2273281 disclosed?
REDHAT-BUG-2273281 was disclosed as part of a security report in 2024.
- agent/severity
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-2700
- agent/last-modified-date
- agent/references
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat build of quarkus