CVE-2021-34797 Apache Geode project log file redaction of sensitive information vulnerability

2022-01-0408:55:20

CWE-532

apache

www.cve.org

cve-2021-34797

apache geode

log file redaction

sensitive information

vulnerability

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

51.2%

JSON

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix “sysprop-”, “javax.net.ssl”, or “security-”. This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

CNA Affected

[
  {
    "product": "Apache Geode",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.12.4",
        "status": "affected",
        "version": "Apache Geode",
        "versionType": "custom"
      }
    ]
  }
]