GHSA-jw3v-5ch2-wfmm

Wildfly logs plaintext passwords

At a glance

Published: 2022-02-15 01:38 UTC
Updated: 2024-02-22 05:16 UTC
CVE: CVE-2020-25640
Aliases: BIT-wildfly-2020-25640
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Affected packages

Package	Versions
Maven · org.wildfly:wildfly-parent	introduced 0, fixed 21.0.0.Final

References

https://nvd.nist.gov/vuln/detail/CVE-2020-25640 ADVISORY
https://github.com/amqphub/amqp-10-resource-adapter/issues/13 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1881637 WEB
https://security.netapp.com/advisory/ntap-20201210-0001 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database