REDHAT-BUG-2342233: Medium severity infinispan Infinispan vulnerability
A vulnerability has been identified in Infinispan where sensitive credentials, such as database usernames and passwords, are logged when using JGroups with JDBCPING. If a misconfiguration (such as an unresolved externaladdr) occurs, the logging mechanism records connection details, including credentials, in plaintext.
This issue can lead to credential exposure, potentially allowing unauthorized access if logs are accessible to low-privileged users or attackers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2342233?
The severity of REDHAT-BUG-2342233 is considered high due to the potential exposure of sensitive credentials.
How do I fix REDHAT-BUG-2342233?
To fix REDHAT-BUG-2342233, ensure that JGroups is properly configured to avoid misconfigurations that lead to logging sensitive information.
What are the risks associated with REDHAT-BUG-2342233?
The risks associated with REDHAT-BUG-2342233 include unauthorized access to database credentials and other sensitive information through logs.
Which software versions are affected by REDHAT-BUG-2342233?
The vulnerability REDHAT-BUG-2342233 affects certain versions of Infinispan when using JGroups with JDBC_PING.
Is there a workaround for REDHAT-BUG-2342233?
A feasible workaround for REDHAT-BUG-2342233 is to review and review your JGroups configuration to prevent logging sensitive details.