Description
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.hazelcast:hazelcast | >= 4.0-BETA-1, <= 4.2.8 | — | GHSA-5gj6-62g7-vmgf |
| Maven | com.hazelcast:hazelcast | >= 5.0-BETA-1, < 5.0.5 | 5.0.5 | GHSA-5gj6-62g7-vmgf |
| Maven | com.hazelcast:hazelcast | >= 5.1-BETA-1, < 5.1.6 | 5.1.6 | GHSA-5gj6-62g7-vmgf |
| Maven | com.hazelcast:hazelcast | >= 5.2-BETA-1, < 5.2.4 | 5.2.4 | GHSA-5gj6-62g7-vmgf |
| Maven | com.hazelcast:hazelcast | >= 5.3.0-BETA-1, < 5.3.0 | 5.3.0 | GHSA-5gj6-62g7-vmgf |
Advisories 2
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1257 Hazelcast IMDG: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 21, 2023