GHSA-mw25-f5r2-hpc6

Source

https://github.com/advisories/GHSA-mw25-f5r2-hpc6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-mw25-f5r2-hpc6/GHSA-mw25-f5r2-hpc6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mw25-f5r2-hpc6

Aliases

CVE-2021-34797

Published

2022-01-06T22:23:25Z

Modified

2023-11-01T04:55:39.600623Z

Summary

Insertion of Sensitive Information into Log File in Apache Geode

Details

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

Database specific

{
    "nvd_published_at": "2022-01-04T09:15:00Z",
    "github_reviewed_at": "2022-01-06T19:57:18Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-532"
    ]
}

References

Affected packages

Maven / org.apache.geode:geode-core

Package

Name: org.apache.geode:geode-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.geode/geode-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.5

Affected versions

1.*

1.0.0-incubating.M2

1.0.0-incubating.M3

1.0.0-incubating

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

1.9.1

1.9.2

1.10.0

1.11.0

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

Maven / org.apache.geode:geode-core

Package

Name: org.apache.geode:geode-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.geode/geode-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.13.0

Fixed

1.13.5

Affected versions

1.*

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4