Homepage
About Snyk

io.quarkus:quarkus-core-deployment@2.8.1.Final vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the io.quarkus:quarkus-core-deployment package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Information Exposure Through Environmental Variables

io.quarkus:quarkus-core-deployment is a Cloud Native, (Linux) Container First framework for writing Java applications

Affected versions of this package are vulnerable to Information Exposure Through Environmental Variables due to the capture of local environment variables from the Quarkus namespace during the application's build process. Running the resulting application inherits the values captured at build time, which may include environment variables or .env facility configurations set for testing purposes. This can lead to unintended behaviour, such as dropping the database during application startup or trusting all TLS certificates, if these values are not overridden.

Note:

This behaviour only happens for configuration properties from the quarkus.* namespace. So, application-specific properties are not captured.

How to fix Information Exposure Through Environmental Variables?

Upgrade io.quarkus:quarkus-core-deployment to version 3.2.11 or higher.

[,3.2.11)
Go back to all versions of this package