GitHub Advisoryadvisory · Maven
GHSA-jqh2-ch7p-xwxh Quarkus CXF logs passwords and other secrets
MEDIUM
Official page ↗
- Aliases
- CVE-2024-9621
- Ecosystem
- Maven
- Packages
- io.quarkiverse.cxf:quarkus-cxf
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-532
- Reviewed
- 2024-10-08
Affected packages
• Maven io.quarkiverse.cxf:quarkus-cxf: < 3.15.2 → fixed in 3.15.2
Description
A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.
Related
Alias · CVE (1)
- CVE-2024-9621 A vulnerability was found in Quarkus CXF. vulnerability
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-9621 advisory
- https://github.com/quarkiverse/quarkus-cxf/issues/1533 web
- https://github.com/quarkiverse/quarkus-cxf/commit/8ed72cab8db8e5659e294b05529d2b45557859bd web
- https://access.redhat.com/errata/RHSA-2024:10035 web
- https://access.redhat.com/security/cve/CVE-2024-9621 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2317130 web
- https://docs.quarkiverse.io/quarkus-cxf/dev/release-notes/3.15.2.html web
- https://github.com/quarkiverse/quarkus-cxf package