Insertion of Sensitive Information into Log File in Apache Geode
High severity
GitHub Reviewed
Published
Jan 6, 2022
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Package
Affected versions
< 1.12.5
>= 1.13.0, < 1.13.5
Patched versions
1.12.5
1.13.5
Description
Published by the National Vulnerability Database
Jan 4, 2022
Reviewed
Jan 6, 2022
Published to the GitHub Advisory Database
Jan 6, 2022
Last updated
Feb 3, 2023
Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
References