{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/cockpit-project/cockpit/","packageName":"quarkus-core","product":"","source":"CNA: redhat","vendor":"","versions":[{"status":"affected","version":"3.8.4"},{"status":"affected","version":"3.2.12"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"HawtIO 4.0.0 for Red Hat build of Apache Camel 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","product":"Red Hat AMQ Streams 2.7.0","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat build of Apicurio Registry 2.6.1 GA","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"io.quarkus/quarkus-core","product":"Red Hat build of Quarkus 3.2.12.Final","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.2.12.Final-redhat-00001","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"io.quarkus/quarkus-core","product":"Red Hat build of Quarkus 3.8.4.redhat","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.8.4.redhat-00002","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/client-kn-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-in-memory-channel-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-istio-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-kafka-broker-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-kafka-broker-post-install-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-kafka-broker-receiver-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-kafka-broker-webhook-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-mtbroker-filter-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-mtbroker-ingress-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-mtchannel-broker-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-mtping-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-storage-version-migration-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/eventing-webhook-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/func-utils-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/ingress-rhel8-operator","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/knative-rhel8-operator","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/kn-cli-artifacts-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/kourier-control-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/net-istio-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/net-istio-webhook-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serverless-operator-bundle","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serverless-rhel8-operator","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-activator-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-autoscaler-hpa-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-autoscaler-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-controller-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-queue-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-storage-version-migration-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/serving-webhook-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1/svls-must-gather-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.33.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8","product":"RHOSS-1.33-RHEL-8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.12.0-4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat build of Apache Camel 4 for Quarkus 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat Build of Keycloak","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat build of OptaPlanner 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat build of Quarkus","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat Integration Camel K 1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-core","product":"Red Hat Integration Camel Quarkus 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-2700","cwes":["CWE-526"],"description":"A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.","epss":{"date":"2026-11-04","percentile":0.23915,"score":0.00309},"exploits":[],"kev":null,"metrics":[{"score":7,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793878301798,"publishedAt":1712238399956,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:11023"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:2106"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:2705"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:3527"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:4028"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:4873"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-2700"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2273281"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:2106"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:2705"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:3527"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:4028"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:4873"},{"source":"ADP: CVE","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2024-2700"},{"source":"ADP: CVE","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2273281"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Currently, no mitigation is available for this vulnerability. Please update as the patches become available."}],"revision":"fb5d3f2dc24881c7300d47968efbb24848b6da20001cfde3f6cfecd9a2986b9e","sources":[{"modifiedAt":1793878301798,"name":"CNA: redhat","retrievedAt":1793880778118,"url":"https://www.cve.org/CVERecord?id=CVE-2024-2700"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793880803131,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2700"}],"ssvc":{"assessedAt":1713905735446,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Quarkus-core: leak of local configuration properties into quarkus applications","updatedAt":1793880803131}