Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-25640 BIT-wildfly-2020-25640EUVD-2022-1084GHSA-jw3v-5ch2-wfmm

Wildfly logs plaintext passwords

Published Nov 24, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Package: org.wildfly:wildfly-parent Ecosystem: Maven

Description

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Affected products

VendorProductAffectedFixed
— wildfly Wildfly 21.0.0.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-7.redhat_00017.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.9-12.SP13_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hal-console 3.2.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.13-1.redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.37-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.8-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-modules 1.11.0-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-4.Final_redhat_00005.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-opentracing-interceptors 0.0.4.1-2.redhat_00002.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.3-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.5-2.GA_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.2.1-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.24-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.5-2.GA_redhat_00001.1.el7eap RHSA-2021:0247

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly:wildfly-parent < 21.0.0.Final 21.0.0.Final GHSA-jw3v-5ch2-wfmm

Advisories 4

References