CVE-2015-1849: Infoleak
First published: Thu Apr 02 2015(Updated: )
It was reported that jboss-negotiation-extras logs LDAP bind credentials when TRACE logging is enabled: <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED CURRENTRELEASE - [GSS](6.4.z) LDAP Bind Credential Password is Logged" href="show_bug.cgi?id=1199641">https://bugzilla.redhat.com/show_bug.cgi?id=1199641</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Enterprise Application Platform | <=6.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1199641
- https://github.com/wildfly-security/jboss-negotiation/pull/21
- https://bugzilla.redhat.com/show_bug.cgi?id=1208580
- https://bugzilla.redhat.com/show_bug.cgi?id=1199641
- https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e
- collector/redhat-bugzilla
- alias/CVE-2015-1849
- collector/nvd-index
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/6.4.0