Review reviewHigh

CVE-2024-2700

Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4, Red Hat AMQ Streams 2.7.0, Red Hat build of Apicurio Registry 2.6.1 GA

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the b...

CVSS: 7
EPSS: 0.29%
CISA KEV: Not listed
Published: 2024.04.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.29%

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4, Red Hat AMQ Streams 2.7.0, Red Hat build of Apicurio Registry 2.6.1 GA
Affected versions: >= 3.8.4, >= 3.2.12
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4, Red Hat AMQ Streams 2.7.0, Red Hat build of Apicurio Registry 2.6.1 GA and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-526