Apache Geode project log file redaction of sensitive information vulnerability
CVE-2021-34797

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Geode
Vendor
CVE Published:
4 January 2022

Summary

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

Affected Version(s)

Apache Geode Apache Geode <= 1.12.4

References

https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52...
x_refsource_MISC
https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Geode would like to thank Aaron Lindsey for reporting this issue.
.