What is GHSA-mw25-f5r2-hpc6?

GHSA-mw25-f5r2-hpc6 is a security advisory published by GitHub Security Advisories with High severity. Insertion of Sensitive Information into Log File in Apache Geode

Which CVE IDs does GHSA-mw25-f5r2-hpc6 cover?

GHSA-mw25-f5r2-hpc6 covers the following CVE IDs: CVE-2021-34797. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mw25-f5r2-hpc6?

GHSA-mw25-f5r2-hpc6 affects 2 products, including: maven/org.apache.geode:geode-core:\u003c 1.12.5; maven/org.apache.geode:geode-core:\u003e= 1.13.0, \u003c 1.13.5.

GHSA-mw25-f5r2-hpc6High

Insertion of Sensitive Information into Log File in Apache Geode

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-34797 →

📋 Description

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

🎯 Affected products2

maven/org.apache.geode:geode-core:< 1.12.5
maven/org.apache.geode:geode-core:>= 1.13.0, < 1.13.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-34797
https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4
https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk
https://github.com/advisories/GHSA-mw25-f5r2-hpc6