Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.quarkus:quarkus-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.0MavenPublished

    quarkus-core leaks local environment variables from Quarkus namespace during application's build

    CVE-2024-2700 · GHSA-f8h5-v2vg-46rr

    Affected
    • Maven io.quarkus:quarkus-core >= 3.9.0.CR1, <= 3.9.1; >= 3.3.0.CR1, <= 3.8.3; < 3.2.12.Final
    Fixed in
    3.2.12.Final3.9.23.8.4· Vendor fix available
    Issue
    A vulnerability was found in the quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application's build. Thus, running the resulting application inherits the values captured at build time. However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It may lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the quarkus. namespace. So, application-specific properties are not captured.

    Recommended action: Upgrade to 3.9.2, 3.8.4 or 3.2.12.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.5MavenPublished

    quarkus-core vulnerable to client driven TLS cipher downgrading

    CVE-2023-2974 · GHSA-3fhx-3vvg-2j84

    Affected
    • Maven io.quarkus:quarkus-core < 2.16.8.Final
    Fixed in
    2.16.8.Final· Vendor fix available
    Issue
    A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

    Recommended action: Upgrade to 2.16.8.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →