SB2022010406 - Unauthorized log files redaction in Apache Geode
Published: January 4, 2022
Security Bulletin ID
SB2022010406
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper neutralization of special elements in output used by a downstream component (CVE-ID: CVE-2021-34797)
The vulnerability allows a remote user to alter log files.
The vulnerability exists due to improper input validation when parsing values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". A remote user can inject specially crafted characters into log files and alter them, hiding initial information.
Remediation
Install update from vendor's website.