CVE-2024-1979: Quarkus: information leak in annotation

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-13 · updated 2026-08-04
Weakness: CWE-200

Description

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.

Affected products

Red Hat build of Quarkus: all versions
Red Hat build of Quarkus 3.2.11.Final: all versions — fixed in 3.2.11.Final-redhat-00001

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.2.11.Final 3.2.11.Final-redhat-00001. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2024:1662
https://access.redhat.com/security/cve/CVE-2024-1979
https://bugzilla.redhat.com/show_bug.cgi?id=2266690
https://github.com/quarkusio/quarkus/issues/38055
https://access.redhat.com/errata/RHSA-2024:1662
https://access.redhat.com/security/cve/CVE-2024-1979
https://bugzilla.redhat.com/show_bug.cgi?id=2266690
https://github.com/quarkusio/quarkus/issues/38055

Get alerted when CVE-2024-1979 or the next vulnerability affects your stack