Cleartext storage of sensitive information in Undertow - CVE-2019-3888
Published: August 13, 2019
Vulnerability identifier: #VU20066
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3888
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange), which includes logging of user credentials. A local user can view contents of log files and gain access to credentials in plain text that are stored in them.
Affected software
Undertow
Red Hat Virtualization
Red Hat Virtualization Host
Fuse
openEuler
undertow
undertow-javadoc
Red Hat Virtualization
Red Hat Virtualization Host
Fuse
openEuler
undertow
undertow-javadoc
How to mitigate CVE-2019-3888
Install updates from vendor's website.
Undertow - update to 2.0.21
Fuse - update to 7.6.0
undertow - update to 1.4.0-4
undertow-javadoc - update to 1.4.0-4
Fuse - update to 7.6.0
undertow - update to 1.4.0-4
undertow-javadoc - update to 1.4.0-4