REDHAT-BUG-2262060: Medium severity jberet jsr352 vulnerability
When the database connection to the job-repository cannot be established (using the JdbcRepository), then an exception is thrown. The exception message is constructed using the 'dbProperties'. The 'dbProperties' might contain username and password for the database-connection.Therefore, database-credentails might be logged unobfuscated as plain text to the console and are visible for everyone that has access to it - which might be a security risk.
Refer: https://github.com/jberet/jsr352/issues/452
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2262060?
The severity of REDHAT-BUG-2262060 has been classified as a potential security risk due to the exposure of sensitive database connection credentials.
How do I fix REDHAT-BUG-2262060?
To fix REDHAT-BUG-2262060, ensure that the database properties do not include sensitive information such as usernames and passwords in error messages.
What impact does REDHAT-BUG-2262060 have on the system?
The impact of REDHAT-BUG-2262060 can lead to unauthorized access to sensitive information if database credentials are exposed through exception messages.
Which software is affected by REDHAT-BUG-2262060?
The software affected by REDHAT-BUG-2262060 is jberet jsr352 when using the JdbcRepository configuration.
Is there a workaround for REDHAT-BUG-2262060?
A potential workaround for REDHAT-BUG-2262060 is to limit the exposure of database properties in exception messages by implementing custom error handling.