REDHAT-BUG-2345172
First published: Wed Feb 12 2025(Updated: )
The vulnerability in Quarkus REST arises when REST endpoints are implemented without a CDI scope and utilize field injection for request parameters. In such cases, a single instance of the endpoint class is shared across multiple concurrent requests, leading to the potential exchange of request parameters between these requests. This means that data such as HTTP headers, URI templates, cookies, and form values from one request can inadvertently be accessed by another, posing significant security risks.Affected applications should ensure proper scoping with @RequestScoped or avoid field injection for request parameters. The issue is fixed in version 3.18.2.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Quarkus | <3.18.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2345172?
The severity of REDHAT-BUG-2345172 is critical due to the potential for data leakage between concurrent requests.
How do I fix REDHAT-BUG-2345172?
To fix REDHAT-BUG-2345172, ensure that REST endpoints in Quarkus are implemented with the correct CDI scopes and avoid using field injection for request parameters.
What versions of Red Hat Quarkus are affected by REDHAT-BUG-2345172?
REDHAT-BUG-2345172 affects all versions of Red Hat Quarkus up to, but not including, version 3.18.2.
What is the impact of not addressing REDHAT-BUG-2345172?
If REDHAT-BUG-2345172 is not addressed, it can lead to unintended sharing of request parameters across multiple users, compromising security.
Is there a workaround for REDHAT-BUG-2345172?
While a permanent fix is recommended, a workaround for REDHAT-BUG-2345172 is to avoid field injection in REST endpoints and use method parameters instead.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-1247
- agent/references
- agent/severity
- agent/last-modified-date
- agent/source
- agent/first-publish-date
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/red hat
- canonical/red hat build of quarkus