Vulnerability · Published Jan 4, 2022 · Assigned by apache

CVE-2021-34797Apache Geode project log file redaction of sensitive information vulnerability

High 7.5

In plain English

A high-severity sensitive data in logs in Apache Geode from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.6%top 14.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.geode:geode-core	1.12.5	GHSA-mw25-f5r2-hpc6
Maven	org.apache.geode:geode-core	1.13.5	GHSA-mw25-f5r2-hpc6

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Geode	Apache Geode – through 1.12.4

Weakness: CWE-532

References

https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk x_refsource_MISC
https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4 x_refsource_MISC