SB2018033019 - Credentials management in Google, mysql
Published: March 30, 2018 Updated: August 8, 2020
Security Bulletin ID
SB2018033019
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Credentials management (CVE-ID: CVE-2016-0898)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM.
Remediation
Install update from vendor's website.