Wildfly logs plaintext passwords

2022-02-1501:38:27

Google

osv.dev

0.001 Low

EPSS

Percentile

42.5%

JSON

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

CPENameOperatorVersion
org.wildfly:wildfly-parenteq12.0.0.CR1
org.wildfly:wildfly-parenteq13.0.0.Final
org.wildfly:wildfly-parenteq15.0.0.Final
org.wildfly:wildfly-parenteq10.0.0.Alpha1
org.wildfly:wildfly-parenteq15.0.0.Beta1
org.wildfly:wildfly-parenteq21.0.0.Beta1
org.wildfly:wildfly-parenteq8.2.1.Final
org.wildfly:wildfly-parenteq14.0.0.Final
org.wildfly:wildfly-parenteq8.0.0.Alpha3
org.wildfly:wildfly-parenteq10.0.0.Beta1

Name	Operator	Version
org.wildfly:wildfly-parent	eq	12.0.0.CR1
org.wildfly:wildfly-parent	eq	13.0.0.Final
org.wildfly:wildfly-parent	eq	15.0.0.Final
org.wildfly:wildfly-parent	eq	10.0.0.Alpha1
org.wildfly:wildfly-parent	eq	15.0.0.Beta1
org.wildfly:wildfly-parent	eq	21.0.0.Beta1
org.wildfly:wildfly-parent	eq	8.2.1.Final
org.wildfly:wildfly-parent	eq	14.0.0.Final
org.wildfly:wildfly-parent	eq	8.0.0.Alpha3
org.wildfly:wildfly-parent	eq	10.0.0.Beta1