Описание
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.
Отчет
All the Red Hat products using the undertow-core jar version 2.0.20 or before are affected.
Меры по смягчению последствий
Use Elytron instead of legacy Security subsystem.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | undertow | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 6 | jbossweb | Out of support scope | ||
| Red Hat JBoss Fuse 6 | undertow | Out of support scope | ||
| Red Hat OpenShift Application Runtimes | undertow | Affected | ||
| Red Hat Process Automation 7 | undertow | Not affected | ||
| Red Hat Single Sign-On 7 | undertow | Affected | ||
| Red Hat Data Grid 7.3.3 | undertow | Fixed | RHSA-2020:0727 | 05.03.2020 |
| Red Hat JBoss EAP 7.2 | undertow | Fixed | RHSA-2019:2938 | 30.09.2019 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-activemq-artemis | Fixed | RHSA-2019:2935 | 01.10.2019 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-codehaus-jackson | Fixed | RHSA-2019:2935 | 01.10.2019 |
Показывать по
Дополнительная информация
Статус:
4.8 Medium
CVSS3
Связанные уязвимости
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for i ...
Potential to access user credentials from the log files when debug logging enabled
Уязвимость компонента io.undertow.request.security веб-сервера Undertow, позволяющая нарушителю получить учетные данные пользователя из файлов журнала
4.8 Medium
CVSS3