CVE-2024-12397

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-12397

CGA ID

CGA-pmfx-5gr2-3p9m

Severity

7.4

High

CVSS V3

Summary

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

References

https://images.chainguard.dev/security/CGA-pmfx-5gr2-3p9m
https://github.com/advisories/GHSA-cxrx-q234-m22m
https://nvd.nist.gov/vuln/detail/CVE-2024-12397
https://github.com/quarkusio/quarkus-http/pull/170
https://github.com/quarkusio/quarkus-http/commit/cfc99d80fce2e3a3dbf06972e648e79e925a7ae7
https://access.redhat.com/security/cve/CVE-2024-12397
https://bugzilla.redhat.com/show_bug.cgi?id=2331298
https://github.com/quarkusio/quarkus-http

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2024-12397

Severity

Summary

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources