io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397

CVE-2024-12397 describes a flaw in Quarkus-HTTP where cookies with certain value-delimiting characters are parsed incorrectly in incoming requests. This can allow an attacker to craft a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, impacting data confidentiality a...

CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

PT-2024-17576 · Unknown · Quarkus-Http

Name of the Vulnerable Software and Affected Versions: Quarkus-HTTP affected versions not specified Description: A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cook...

Quarkus 环境问题漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. An environmental issue vulnerability exists in Quarkus that stems from the inclusion of an HTTP cookie smuggling issue...

Unauthorized Access

org.keycloak, keycloak-quarkus-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access controls, allowing a high-privileged user to read sensitive information from a Vault file outside the expected context...

Sensitive Data Exposure

org.keycloak, keycloak-quarkus-server is vulnerable to Sensitive Data Exposure. The vulnerability is due to the capture of sensitive runtime values, such as passwords, during the build process and their embedding as default values in bytecode, which allows an attacker to access sensitive data...

(RHSA-2024:10861) Moderate: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.2.GA)

An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available RHBQ 3.15.2.GA. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products: CVE-2024-31141...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0 <=5.5.1), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1 <=9.1) +24 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=26.0.0 <=26.5.6)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=26.0.5) +6 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=26.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =26.0.0, =25.0.0, =25.0.0, =26.0.0, =26.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0), org.keycloak:keycloak-guides (>=21.0.0 <=21.1.2) +5 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=21.0.0 <=21.1.2)

org.keycloak:keycloak-quarkus-server MAVEN version =21.0.0, =0.1.0, =21.0.0, =21.0.0, =21.1.0, =21.0.0, =21.0.0, =21.0.0, =21.1.2 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=15.1.0 <=15.1.1), org.keycloak:keycloak-guides-maven-plugin (>=15.1.0 <=15.1.1) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=15.0.0 <=15.1.1)

org.keycloak:keycloak-quarkus-server MAVEN version =15.0.0, =15.1.0, =15.1.0, =15.1.0, =15.0.0, =15.0.0, =15.1.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=2.7.4-24.0), org.keycloak:keycloak-guides (>=24.0.0 <=24.0.5) +4 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=24.0.0 <=24.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =24.0.0, =2.5.6-24.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=19.0.0 <=19.0.3), org.keycloak:keycloak-guides-maven-plugin (>=19.0.0 <=19.0.3) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=19.0.0 <=19.0.3)

org.keycloak:keycloak-quarkus-server MAVEN version =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.3 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=18.0.0 <=18.0.2), org.keycloak:keycloak-guides-maven-plugin (>=18.0.0 <=18.0.2) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=18.0.0 <=18.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.2 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-quarkus-server-app (=14.0.0), org.keycloak:keycloak-quarkus-server-deployment (=14.0.0) potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (=14.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version =14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-quarkus-server-app =14.0.0 -...

org.keycloak:keycloak-quarkus-server-app (>=13.0.0 <=13.0.1), org.keycloak:keycloak-quarkus-server-deployment (>=13.0.0 <=13.0.1) potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=13.0.0 <=13.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version =13.0.0, =13.0.0, =13.0.0, =13.0.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=23.0.0 <=23.0.7), org.keycloak:keycloak-guides-maven-plugin (>=23.0.0 <=23.0.7) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=23.0.0 <=23.0.7)

org.keycloak:keycloak-quarkus-server MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.7 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...