Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

cve-program · CVE-2024-12397

Published

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2024-12397

Published

quarkus-http

https://github.com/quarkusio/quarkus-http

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "5.3.4",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "quarkus-http",
                    "collectionURL": "https://github.com/quarkusio/quarkus-http",
                    "defaultStatus": "unaffected"
                }

cryostat/cryostat-agent-init-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-agent-init-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0.5.0-6",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-db-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-db-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-grafana-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-grafana-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-openshift-console-plugin-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-operator-bundle

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-operator-bundle",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-ose-oauth-proxy-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-ose-oauth-proxy-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-reports-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-reports-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-rhel9-operator

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-rhel9-operator",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/cryostat-storage-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/cryostat-storage-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

cryostat/jfr-datasource-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 4 on RHEL 9",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cryostat/jfr-datasource-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "4.0.0-7",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:cryostat:4::el9"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "HawtIO HawtIO 4.2.0",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "unaffected",
                    "packageName": "quarkus-http-core",
                    "cpes": [
                        "cpe:/a:redhat:apache_camel_hawtio:4.2::el6"
                    ]
                }

Red Hat Build of Keycloak

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:26.2"
                    ]
                }

rhbk/keycloak-operator-bundle

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Keycloak 26.2",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhbk/keycloak-operator-bundle",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "26.2.4-2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:26.2::el9"
                    ]
                }

rhbk/keycloak-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Keycloak 26.2",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhbk/keycloak-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "26.2-3",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:26.2::el9"
                    ]
                }

rhbk/keycloak-rhel9-operator

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Keycloak 26.2",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhbk/keycloak-rhel9-operator",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "26.2-3",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:26.2::el9"
                    ]
                }

quarkus-http-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Quarkus 3.15.3",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "defaultStatus": "unaffected",
                    "packageName": "quarkus-http-core",
                    "cpes": [
                        "cpe:/a:redhat:quarkus:3.15"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cryostat:3"
                    ]
                }

quarkus-camel-bom

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-camel-bom",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_quarkus:3"
                    ]
                }

quarkus-cxf-bom

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-cxf-bom",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_quarkus:3"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apicurio Registry 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:service_registry:2"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of OptaPlanner 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:optaplanner:::el6"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Fuse 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_fuse:7"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Integration Camel K 1",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_k:1"
                    ]
                }

quarkus-http-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 8",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:8"
                    ]
                }

quarkus-http-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:jbosseapxp"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Process Automation 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_bpms:7"
                    ]
                }

quarkus-http-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "streams for Apache Kafka",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "quarkus-http-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:amq_streams:1"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 13:16 UTC · 255 of 275 readable · 250 fully read · documentation 469/469 current