On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
www.openwall.com/lists/oss-security/2022/01/25/7
www.openwall.com/lists/oss-security/2022/01/26/4
github.com/apache/incubator-shenyu
github.com/apache/incubator-shenyu/releases/tag/v2.4.2
github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654
github.com/apache/shenyu/pull/2357
lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
nvd.nist.gov/vuln/detail/CVE-2022-23223