CVE-2024-1102: Jberet: jberet-core logging database credentials
A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.
Other sources
When the database connection to the job-repository cannot be established (using the JdbcRepository), then an exception is thrown. The exception message is constructed using the 'dbProperties'. The 'dbProperties' might contain username and password for the database-connection.Therefore, database-credentails might be logged unobfuscated as plain text to the console and are visible for everyone that has access to it - which might be a security risk.
Refer: https://github.com/jberet/jsr352/issues/452
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jberet:jberet-coreto a version that resolves this vulnerability.Fixed in 2.2.1.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1102?
CVE-2024-1102 is a vulnerability that can potentially expose user credentials, which is considered a significant security risk.
How do I fix CVE-2024-1102?
To fix CVE-2024-1102, you should update jberet-core to version 2.2.1.Final or later.
Which versions of jberet-core are affected by CVE-2024-1102?
CVE-2024-1102 affects all versions of jberet-core up to but not including version 2.2.1.Final.
What types of software are impacted by CVE-2024-1102?
CVE-2024-1102 impacts jberet-core and may also affect JBoss Enterprise Application Platform versions 8.0 and earlier.
What are the implications of CVE-2024-1102 for database security?
The implications of CVE-2024-1102 include the risk of exposing sensitive database connection credentials, which can be exploited by attackers.