Quarkus-core: leak of local configuration properties into quarkus applications

CVE-2024-2700

Summary

A vulnerability exists in the Quarkus core component, where local environment variables prefixed by 'quarkus.' can be inadvertently inherited by the application during its build process. This occurs when developers or CI environments utilize such variables for testing purposes, like database modifications or TLS certificate trust settings. If these properties are not explicitly overridden in the application code, their presence in the built application can lead to risky behaviors, potentially exposing the application to unintended effects or vulnerabilities. It's important to note that this behavior is limited to the 'quarkus.' namespace, and application-specific properties remain unaffected.

References