Threats Tagged 'cve-2024-9621'

A critical security update is available for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 (RHBQ 3.8.6.SP2). It addresses multiple vulnerabilities including CVE-2024-51132, which involves arbitrary code execution via specially-crafted FHIR requests, and CVE-2024-9621, where Quarkus CXF may log user passwords and secrets to application logs. The FHIR vulnerability stems from improper handling of XML external entities, potentially allowing attackers to execute code or access sensitive information. Red Hat notes that FHIR is out of support scope for this product and that the impact on Red Hat Fuse 7 is low due to non-utilization of the affected function. The update improves security and stability, and users are advised to back up their installations before applying it.

A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.