Vulnerabilites related to Red Hat - Red Hat build of Quarkus 3.15.3
cve-2024-12397
Vulnerability from cvelistv5
Published
2024-12-12 09:05
Modified
2025-03-06 18:31
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
References
https://access.redhat.com/errata/RHSA-2025:0900vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:1082vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-12397vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2331298issue-tracking, x_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15     cpe:/a:redhat:camel_quarkus:3.15
 Create a notification for this product.
   Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15     cpe:/a:redhat:camel_quarkus:3.15
 Create a notification for this product.
   Red Hat Red Hat build of Quarkus 3.15.3     cpe:/a:redhat:quarkus:3.15::el8
 Create a notification for this product.
   Red Hat Cryostat 3     cpe:/a:redhat:cryostat:3
 Create a notification for this product.
   Red Hat Red Hat build of Apache Camel - HawtIO 4     cpe:/a:redhat:rhboac_hawtio:4
 Create a notification for this product.
   Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
 Create a notification for this product.
   Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
 Create a notification for this product.
   Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
 Create a notification for this product.
   Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
 Create a notification for this product.
   Red Hat Red Hat Integration Camel K 1     cpe:/a:redhat:integration:1
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
 Create a notification for this product.
   Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
 Create a notification for this product.
   Red Hat streams for Apache Kafka     cpe:/a:redhat:amq_streams:1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-12397",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-12-12T15:31:47.316503Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-12-12T15:45:08.143Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:3.15",
               ],
               defaultStatus: "unaffected",
               packageName: "com.redhat.quarkus.platform/quarkus-camel-bom",
               product: "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:3.15",
               ],
               defaultStatus: "unaffected",
               packageName: "com.redhat.quarkus.platform/quarkus-cxf-bom",
               product: "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:quarkus:3.15::el8",
               ],
               defaultStatus: "unaffected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat build of Quarkus 3.15.3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:cryostat:3",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Cryostat 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhboac_hawtio:4",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat build of Apache Camel - HawtIO 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat build of Apicurio Registry 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat Build of Keycloak",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:optaplanner:::el6",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat build of OptaPlanner 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unknown",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat Integration Camel K 1",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "unaffected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_streams:1",
               ],
               defaultStatus: "affected",
               packageName: "io.quarkus.http/quarkus-http-core",
               product: "streams for Apache Kafka",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2024-12-10T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoof arbitrary additional cookie values, leading to unauthorized\ndata access or modification. The main threat from this flaw impacts data\nconfidentiality and integrity.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-444",
                     description: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-06T18:31:46.240Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:0900",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:0900",
            },
            {
               name: "RHSA-2025:1082",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:1082",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-12397",
            },
            {
               name: "RHBZ#2331298",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2331298",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-12-10T01:15:33.380000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-12-10T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling",
         workarounds: [
            {
               lang: "en",
               value: "Currently, no mitigation is available for this vulnerability.",
            },
         ],
         x_redhatCweChain: "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-12397",
      datePublished: "2024-12-12T09:05:28.451Z",
      dateReserved: "2024-12-10T01:22:12.303Z",
      dateUpdated: "2025-03-06T18:31:46.240Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}