Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2024-2700
PUBLISHED
More InfoOfficial Page
Assigner-redhat
Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749
View Known Exploited Vulnerability (KEV) details
Published At-04 Apr, 2024 | 13:46
Updated At-18 Jun, 2025 | 18:10
Rejected At-
▼CVE Numbering Authority (CNA)
Quarkus-core: leak of local configuration properties into quarkus applications

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.

Affected Products
Collection URL
https://github.com/cockpit-project/cockpit/
Package Name
quarkus-core
Default Status
unaffected
Versions
Affected
  • 3.8.4
  • 3.2.12
Vendor
Red Hat, Inc.Red Hat
Product
HawtIO 4.0.0 for Red Hat build of Apache Camel 4
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:rhboac_hawtio:4.0.0
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat AMQ Streams 2.7.0
Collection URL
https://access.redhat.com/downloads/content/package-browser/
CPEs
  • cpe:/a:redhat:amq_streams:2
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apicurio Registry 2.6.1 GA
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:apicurio_registry:2.6
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Quarkus 3.2.12.Final
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.quarkus/quarkus-core
CPEs
  • cpe:/a:redhat:quarkus:3.2::el8
Default Status
affected
Versions
Unaffected
  • From 3.2.12.Final-redhat-00001 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Quarkus 3.8.4.redhat
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.quarkus/quarkus-core
CPEs
  • cpe:/a:redhat:openshift_application_runtimes:1.0
Default Status
affected
Versions
Unaffected
  • From 3.8.4.redhat-00002 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/client-kn-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-in-memory-channel-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-istio-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-kafka-broker-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-kafka-broker-post-install-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-kafka-broker-receiver-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-kafka-broker-webhook-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-mtbroker-filter-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-mtbroker-ingress-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-mtchannel-broker-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-mtping-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-storage-version-migration-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/eventing-webhook-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/func-utils-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/ingress-rhel8-operator
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-5 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/knative-rhel8-operator
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-5 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/kn-cli-artifacts-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/kourier-control-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/net-istio-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/net-istio-webhook-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serverless-operator-bundle
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serverless-rhel8-operator
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-5 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-activator-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-autoscaler-hpa-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-autoscaler-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-controller-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-queue-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-storage-version-migration-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/serving-webhook-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1/svls-must-gather-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.33.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
RHOSS-1.33-RHEL-8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8
CPEs
  • cpe:/a:redhat:openshift_serverless:1.33::el8
Default Status
affected
Versions
Unaffected
  • From 1.12.0-4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel 4 for Quarkus 3
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:camel_quarkus:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel - HawtIO 4
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:apache_camel_hawtio:4
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of OptaPlanner 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:optaplanner:::el6
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Quarkus
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.quarkus/quarkus-core
CPEs
  • cpe:/a:redhat:quarkus:2
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Integration Camel K 1
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:integration:1
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Integration Camel Quarkus 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
quarkus-core
CPEs
  • cpe:/a:redhat:camel_quarkus:2
Default Status
affected
Problem Types
TypeCWE IDDescription
CWECWE-526Cleartext Storage of Sensitive Information in an Environment Variable
Metrics
VersionBase scoreBase severityVector
3.17.0HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Red Hat severity rating
value:
Moderate
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Currently, no mitigation is available for this vulnerability. Please update as the patches become available.

Exploits

Credits

Timeline
EventDate
Reported to Red Hat.2024-04-03 00:00:00
Made public.2024-04-03 00:00:00
Replaced By

Rejected Reason

References
HyperlinkResource
https://access.redhat.com/errata/RHSA-2024:11023
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2106
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2705
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3527
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4028
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4873
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-2700
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2273281
issue-tracking
x_refsource_REDHAT
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://access.redhat.com/errata/RHSA-2024:2106
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:2705
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:3527
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4028
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4873
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/security/cve/CVE-2024-2700
vdb-entry
x_refsource_REDHAT
x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=2273281
issue-tracking
x_refsource_REDHAT
x_transferred
Details not found