Information Exposure Through Environmental Variables Affecting io.quarkus:quarkus-core-deployment package, versions [,3.2.11)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-IOQUARKUS-6596815
- published 11 Apr 2024
- disclosed 4 Apr 2024
- credit Unknown
Introduced: 4 Apr 2024
CVE-2024-2700 Open this link in a new tabHow to fix?
Upgrade io.quarkus:quarkus-core-deployment to version 3.2.11 or higher.
Overview
io.quarkus:quarkus-core-deployment is a Cloud Native, (Linux) Container First framework for writing Java applications
Affected versions of this package are vulnerable to Information Exposure Through Environmental Variables due to the capture of local environment variables from the Quarkus namespace during the application's build process. Running the resulting application inherits the values captured at build time, which may include environment variables or .env facility configurations set for testing purposes. This can lead to unintended behaviour, such as dropping the database during application startup or trusting all TLS certificates, if these values are not overridden.
Note:
This behaviour only happens for configuration properties from the quarkus.* namespace. So, application-specific properties are not captured.