Security Bulletin: Vulnerabilities in Quarkus-HTTP affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Quarkus-HTTP has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-12397 DESCRIPTION: A...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.6.0, <=1.6.20), com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.3.0) +137 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.18.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.18.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.6.0, =1.1.0, =1.1.0,...

br.com.labbs:quarkus-monitor-deployment (>=0.1.5, <=0.3.0), com.blazebit:blaze-persistence-examples-quarkus-base (1.6.0-alpha2) +48 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.15.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - br.com.labbs:quarkus-monitor-deployment =0.1.5, =1.7.6.final, =0.0.9, =1.7.6.final,...

com.alibaba.csp:sentinel-jax-rs-quarkus-adapter-deployment (>=1.8.0, <=1.8.10), com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha2) +38 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.6.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.alibaba.csp:sentinel-jax-rs-quarkus-adapter-deployment =1.8.0, =1.4.0.final,...

io.quarkus.http:quarkus-http-servlet (3.0.10.final), io.quarkus.http:quarkus-http-websockets-jsr (3.0.10.final) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.10.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.10.final -...

com.github.mcollovati:quarkus-hilla-deployment (1.0.0-alpha1), com.vaadin:vaadin-quarkus (>=1.0.1, <=1.1.3) +164 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (4.1.4)

io.quarkus.http:quarkus-http-core MAVEN version 4.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.github.mcollovati:quarkus-hilla-deployment 1.0.0-alpha1 - com.vaadin:vaadin-quarkus =1.0....

fr.lixbox.lixbox-cache:lixbox-cache-ui (11.1.2.23), fr.lixbox.lixbox-param:lixbox-param-ui (11.1.2.24) +50 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (4.1.7)

io.quarkus.http:quarkus-http-core MAVEN version 4.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - fr.lixbox.lixbox-cache:lixbox-cache-ui 11.1.2.23 - fr.lixbox.lixbox-param:lixbox-param-ui...

CVE-2024-12397 vulnerabilities

Vulnerabilities for packages: keycloak, apicurio-registry...

CVE-2024-12397 vulnerabilities

Vulnerabilities for packages: keycloak, apicurio-registry...

CVE-2024-12397

creationtimestamp| type| source ---|---|--- 2024-12-12 09:08:18+00:00| seen| https://infosec.exchange/users/cve/statuses/113639063433232775 2024-12-12 11:19:28+00:00| seen| https://t.me/cvedetector/12759 2025-03-19 17:20:59+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8096 2025-05-02...

CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397

CVE-2024-12397 describes a flaw in Quarkus-HTTP where cookies with certain value-delimiting characters are parsed incorrectly in incoming requests. This can allow an attacker to craft a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, impacting data confidentiality a...