This vulnerability involves the inadvertent exposure of git credentials in Quarkus projects during continuous integration builds. It requires three conditions: presence of a token in the Git URL, use of a Quarkus extension generating Kubernetes descriptors, and automatic publication of these descriptors as build artifacts. Because all three conditions must be met, exploitation chances are limited. The issue is tracked as CVE-2024-1979 with a CVSS v3.1 base score of 3.5 (low severity). Red Hat has released a security update in Quarkus 3.2.11 that addresses this and other vulnerabilities. Users are advised to ensure at least one of the preconditions is not present to mitigate risk.

The vulnerability could lead to the exposure of sensitive git credentials to unauthorized actors, potentially compromising the git repository. However, exploitation is limited by the requirement of three specific conditions that must all be met. The confidentiality impact is rated low, with no impact on integrity or availability. There are no known exploits in the wild at this time.

Red Hat has released an official security update in Red Hat build of Quarkus 3.2.11 that fixes this vulnerability. Users should apply this update after ensuring all previous relevant errata are applied. Additionally, mitigating the risk can be achieved by ensuring that at least one of the three preconditions (token in Git URL, use of Kubernetes descriptor-generating Quarkus extension, automatic publishing of descriptors as build artifacts) is not present in the build environment. No other specific mitigations are required.