CVE-2014-0085: Low severity redhat JBoss A-MQ vulnerability
Graeme Colman of Red Hat reported a sensitive data exposure flaw in Apache Zookeeper. An admin user's password appeared in plaintext in binary log files. A local user could read this information and use it to gain administrative access to the application.
Update 2018-08-06:
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. This issue is a vulnerability in JBoss Fuse's usage of Apache Zookeeper, not in Zookeeper itself as was previously stated.
Other sources
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0085?
CVE-2014-0085 is considered a critical vulnerability due to the potential for unauthorized administrative access through sensitive data exposure.
How does CVE-2014-0085 affect Apache Zookeeper?
CVE-2014-0085 affects Apache Zookeeper by exposing an admin user's password in plaintext within binary log files accessible to local users.
How can I mitigate CVE-2014-0085?
To mitigate CVE-2014-0085, admins should ensure that log files are adequately protected and update to patched versions of affected software.
Which software versions are impacted by CVE-2014-0085?
CVE-2014-0085 specifically impacts Red Hat JBoss A-MQ and Red Hat JBoss Fuse version 6.0.0.
What type of vulnerability is CVE-2014-0085 classified as?
CVE-2014-0085 is classified as a sensitive data exposure vulnerability.