Detections
Analytics

SCA: security update for io.quarkus:quarkus-core (GHSA-f8h5-v2vg-46rr)

high Tenable Self-Hosted Container Security Plugin ID 414385

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from
 the Quarkus namespace during the application's build, therefore, running the resulting application
 inherits the values captured at build time. Some local environment variables may have been set by the
 developer or CI environment for testing purposes, such as dropping the database during application startup
 or trusting all TLS certificates to accept self-signed certificates. If these properties are configured
 using environment variables or the .env facility, they are captured into the built application, which can
 lead to dangerous behavior if the application does not override these values. This behavior only happens
 for configuration properties from the `quarkus.*` namespace. Application-specific properties are not
 captured. (CVE-2024-2700)

See Also

https://github.com/advisories/GHSA-f8h5-v2vg-46rr

Plugin Details

Severity: High

ID: 414385

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.49

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-2700

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/4/2024

Vulnerability Publication Date: 4/4/2024

Reference Information

CVE: CVE-2024-2700

cwe: CWE-526