at.meks.quarkiverse.axonframework-extension:quarkus-axon-metrics-deployment (>=0.1.0-rc2, <=0.1.0-quarkus-3.15-rc4), br.com.labbs:quarkus-monitor-reactive-deployment (>=2.0.0, <=3.8.2) +152 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (>=5.0.0.alpha1, <=5.3.3)

io.quarkus.http:quarkus-http-core MAVEN version =5.0.0.alpha1, =0.1.0-rc2, =2.0.0, =1.6.9, =1.0.0-alpha.0, =1.0.0, =1.0.0, =2.0.0-alpha1, =2.4.1, =2.4.1, =2.0.0-alpha1, =2.4.1, =2.4.1, =0.1.0, =0.1.2 and more Source cves: CVE-2024-12397 Source advisory: GHSA-CXRX-Q234-M22M...

CVE-2024-12397

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397

CVE-2024-12397 describes a flaw in Quarkus-HTTP where cookies with certain value-delimiting characters are parsed incorrectly in incoming requests. This can allow an attacker to craft a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, impacting data confidentiality a...

CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

at.meks.quarkiverse.axonframework-extension:quarkus-axon-metrics-deployment (>=0.1.0-rc2, <=0.1.0-quarkus-3.15-rc4), br.com.labbs:quarkus-monitor-deployment (>=0.1.5, <=0.3.0) +453 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (>=3.0.0.alpha1, <=5.3.3)

io.quarkus.http:quarkus-http-core MAVEN version =3.0.0.alpha1, =0.1.0-rc2, =0.1.5, =1.0.4, =1.8.0, =1.6.9, =1.5.0-alpha2, =1.0.0-alpha.0, =1.1.0, =1.1.0, =1.0.0, =0.0.10, =1.0.0-alpha1, =24.6.0 and more Source cves: CVE-2024-12397 Source advisory: MEND:CVE-2024-12397...

CVE-2024-12397: Inconsistent Interpretation of HTTP Requests

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

PT-2024-17576

Name of the Vulnerable Software and Affected Versions Quarkus-HTTP affected versions not specified Description A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie...