GHSA-jw3v-5ch2-wfmm

Wildfly logs plaintext passwords

En bref

Publiée: 2022-02-15 01:38 UTC
Mise à jour: 2024-02-22 05:16 UTC
CVE: CVE-2020-25640
Alias: BIT-wildfly-2020-25640
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Paquets affectés

Paquet	Versions
Maven · org.wildfly:wildfly-parent	introduced 0, fixed 21.0.0.Final

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-25640 ADVISORY
https://github.com/amqphub/amqp-10-resource-adapter/issues/13 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1881637 WEB
https://security.netapp.com/advisory/ntap-20201210-0001 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database