Homepage

io.quarkus:quarkus-core-deployment@0.17.0 vulnerabilities

  • latest version

    3.26.1

  • latest non vulnerable version

    3.26.1

  • first published

    6 years ago

  • latest version published

    14 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.quarkus:quarkus-core-deployment package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Information Exposure Through Environmental Variables

    io.quarkus:quarkus-core-deployment is a Cloud Native, (Linux) Container First framework for writing Java applications

    Affected versions of this package are vulnerable to Information Exposure Through Environmental Variables due to the capture of local environment variables from the Quarkus namespace during the application's build process. Running the resulting application inherits the values captured at build time, which may include environment variables or .env facility configurations set for testing purposes. This can lead to unintended behaviour, such as dropping the database during application startup or trusting all TLS certificates, if these values are not overridden.

    Note:

    This behaviour only happens for configuration properties from the quarkus.* namespace. So, application-specific properties are not captured.

    How to fix Information Exposure Through Environmental Variables?

    Upgrade io.quarkus:quarkus-core-deployment to version 3.2.11 or higher.

    [,3.2.11)
    Go back to all versions of this package