CVE-2024-1979
Quarkus: information leak in annotation
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Quarkus: information leak in annotation
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
CVE-2024-1979- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-0859
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
EUVD-2024-0859- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7g97-7r3c-5cc6
In Quarkus, git credentials could be inadvertently published
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
GHSA-7g97-7r3c-5cc6- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
CVE-2024-1979- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Quarkus: information leak in annotation
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
CVE-2024-1979- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-7g97-7r3c-5cc6
In Quarkus, git credentials could be inadvertently published
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- Record
GHSA-7g97-7r3c-5cc6- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-kubernetes-deploymentMaven |
before 3.7.3 | 3.7.3 |
io.quarkus:quarkus-kubernetes-deploymentMaven |
before 3.7.3, plus listed versions 0.13.00.13.10.13.20.13.30.14.0 Show 45 moreShow less0.15.00.16.00.16.10.17.00.18.00.19.00.19.10.20.00.21.00.21.10.21.20.22.00.23.00.23.10.23.20.24.00.25.00.26.00.26.10.27.00.28.00.28.11.0.0.CR11.0.0.CR21.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final |
3.7.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1979 is a low vulnerability (CVSS 3.5) in Red Hat Build Of Quarkus, published March 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in io.quarkus:quarkus-kubernetes-deployment 3.7.3.
References
Left out here: 229 versions. The JSON record has them.