CVE-2024-12397

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Reserved 2024-12-10 | Published 2024-12-12 | Updated 2024-12-13 | Assigner redhat

Problem types

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Product status

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
unknown

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2024-12-10:	Reported to Red Hat.
2024-12-10:	Made public.

References

access.redhat.com/security/cve/CVE-2024-12397 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2331298 (RHBZ#2331298) issue-tracking

cve.org (CVE-2024-12397)

nvd.nist.gov (CVE-2024-12397)

Download JSON