CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with
certain value-delimiting characters in incoming requests. This issue could
allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie
values or spoof arbitrary additional cookie values, leading to unauthorized
data access or modification. The main threat from this flaw impacts data
confidentiality and integrity.
Problem types: cwe_id: CWE-444
description: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: default_status: unaffected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: Cryostat 4 on RHEL 9
cpes: cpe:/a:redhat:cryostat:4::el9
default_status: affected
vendor: Red Hat
product: HawtIO HawtIO 4.2.0
cpes: cpe:/a:redhat:apache_camel_hawtio:4.2::el6
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Quarkus 3.15.3
cpes: cpe:/a:redhat:quarkus:3.15::el8
default_status: unaffected
vendor: Red Hat
product: Cryostat 3
cpes: cpe:/a:redhat:cryostat:3
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel 4 for Quarkus 3
cpes: cpe:/a:redhat:camel_quarkus:3
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel 4 for Quarkus 3
cpes: cpe:/a:redhat:camel_quarkus:3
default_status: affected
vendor: Red Hat
product: Red Hat build of Apicurio Registry 2
cpes: cpe:/a:redhat:service_registry:2
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: affected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: unknown
vendor: Red Hat
product: Red Hat Integration Camel K 1
cpes: cpe:/a:redhat:integration:1
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: streams for Apache Kafka
cpes: cpe:/a:redhat:amq_streams:1
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-12-12T09:05:28.451Z