REDHAT-BUG-1063642: Low severity JBoss PicketBox vulnerability

Published Feb 11, 2014

Updated

It was identified that security auditing provided by JBossSX/PicketBox logged sensitive information into a world readable audit.log file. This information could be used by a local attacker to gain otherwise protected information about user sessions etc.

Affected Software

1 affected component

JBoss PicketBox

Event History

Feb 11, 2014

Data Sourced

via Red Hat·07:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1063642?

The severity of REDHAT-BUG-1063642 is considered moderate due to the potential exposure of sensitive information.

How do I fix REDHAT-BUG-1063642?

To fix REDHAT-BUG-1063642, ensure to update your JBoss PicketBox to a secure version that addresses the logging vulnerabilities.

What information is exposed by REDHAT-BUG-1063642?

REDHAT-BUG-1063642 exposes sensitive information stored in a world-readable audit.log file, which could reveal user session details.

Who is affected by REDHAT-BUG-1063642?

JBoss PicketBox installations that utilize security auditing features are affected by REDHAT-BUG-1063642.

Can local attackers exploit REDHAT-BUG-1063642?

Yes, local attackers can exploit REDHAT-BUG-1063642 to access protected information by reading the audit.log file.