REDHAT-BUG-2273281: Medium severity Red Hat Quarkus vulnerability
A vulnerability was found in quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application's build. Thus, running the resulting application inherits the values captured at build time.
However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It leads to dangerous behavior if the application does not override these values.
This behavior only happens for configuration properties from the quarkus. namespace. So, application-specific properties are not captured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure that local environment variables used during the Quarkus build are not set to insecure testing values in the `quarkus.*` namespace (e.g., variables that drop the database during startup or that trust all TLS certificates to accept self-signed certificates).
- Compensating control
If any insecure `quarkus.*` values were provided via environment variables or the `.env` facility, override them in the running application (do not rely on inherited build-time values).
- Operational
Rebuild and redeploy the application after removing the insecure `quarkus.*` environment variables (or `.env` entries) from the developer/CI build environment so the resulting application no longer inherits them.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2273281?
The severity of REDHAT-BUG-2273281 is high due to the potential exposure of sensitive local environment variables.
How do I fix REDHAT-BUG-2273281?
Fixing REDHAT-BUG-2273281 involves updating to the latest patched version of the Quarkus software.
What components are affected by REDHAT-BUG-2273281?
REDHAT-BUG-2273281 primarily affects the quarkus-core component of the Red Hat Build of Quarkus.
What is the impact of REDHAT-BUG-2273281?
The impact of REDHAT-BUG-2273281 is that it can lead to unintended exposure of environment variables, which may contain sensitive information.
When was REDHAT-BUG-2273281 disclosed?
REDHAT-BUG-2273281 was disclosed as part of a security report in 2024.