Inclusion of Sensitive Information in Log Files in jsr352 - CVE-2024-1102

Vulnerability identifier: #VU92280

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-1102

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files, such as database connection credentials. A local user can read the log files and gain access to sensitive data.

jsr352
JBoss Enterprise Application Platform
eap8-jose4j (Red Hat package)
eap8-guava-failureaccess (Red Hat package)
eap8-amazon-ion-java (Red Hat package)
eap8-reactive-streams (Red Hat package)
eap8-fge-msg-simple (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-log4j2-jboss-logmanager (Red Hat package)
eap8-jakarta-json (Red Hat package)
eap8-fge-btf (Red Hat package)
eap8-java-classmate (Red Hat package)
eap8-wsdl4j (Red Hat package)
eap8-jasypt (Red Hat package)
eap8-apache-commons-beanutils (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-atinject (Red Hat package)
eap8-angus-activation (Red Hat package)
eap8-jakarta-transaction-api (Red Hat package)
eap8-jgroups-kubernetes (Red Hat package)
eap8-angus (Red Hat package)
eap8-wildfly-http-client (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-jakarta-interceptor-api (Red Hat package)
eap8-jakarta-batch-api (Red Hat package)
eap8-jakarta-annotation-api (Red Hat package)
eap8-jakarta-mail (Red Hat package)
eap8-jakarta-activation (Red Hat package)
eap8-jakarta-json-api (Red Hat package)
eap8-jberet (Red Hat package)
eap8-jboss-modules (Red Hat package)
eap8-wildfly-elytron (Red Hat package)
eap8-ws-commons-XmlSchema (Red Hat package)
eap8-velocity (Red Hat package)
eap8-gson (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-apache-sshd (Red Hat package)
eap8-joda-time (Red Hat package)
eap8-jackson-annotations (Red Hat package)
eap8-jackson-modules-java8 (Red Hat package)
eap8-jackson-databind (Red Hat package)
eap8-jackson-core (Red Hat package)
eap8-jackson-dataformats-binary (Red Hat package)
eap8-jackson-jaxrs-providers (Red Hat package)
eap8-jackson-modules-base (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-wss4j (Red Hat package)
eap8-jakarta-validation-api (Red Hat package)
eap8-yasson (Red Hat package)
eap8-wildfly-transaction-client (Red Hat package)
eap8-ironjacamar (Red Hat package)
eap8-javaee-jpa-spec (Red Hat package)
eap8-jakarta-ws-rs-api (Red Hat package)
eap8-jakarta-jms-api (Red Hat package)
eap8-caffeine (Red Hat package)
eap8-hal-console (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jakarta-xml-bind-api (Red Hat package)
eap8-elytron-web (Red Hat package)
eap8-jaxb (Red Hat package)
eap8-sun-istack-commons (Red Hat package)
eap8-httpcomponents-asyncclient (Red Hat package)
eap8-netty (Red Hat package)
eap8-netty-transport-native-epoll (Red Hat package)
eap8-stax2-api (Red Hat package)
eap8-httpcomponents-core (Red Hat package)
eap8-httpcomponents-client (Red Hat package)
eap8-protostream (Red Hat package)
eap8-antlr4 (Red Hat package)
eap8-jboss-ejb-client (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-jakarta-servlet-api (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate-search (Red Hat package)
eap8-resteasy (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-woodstox-core (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-lucene-solr (Red Hat package)
eap8-infinispan (Red Hat package)
eap8-guava-libraries (Red Hat package)

Install updates from vendor's website.

jsr352 - update to 2.2.1
JBoss Enterprise Application Platform - update to 8.0.2
eap8-jose4j (Red Hat package) - addressed in versions 0.9.3-2.redhat_00004.1.el8eap, 0.9.3-2.redhat_00004.1.el9eap
eap8-guava-failureaccess (Red Hat package) - addressed in versions 1.0.1-4.redhat_00012.1.el8eap, 1.0.1-4.redhat_00012.1.el9eap
eap8-amazon-ion-java (Red Hat package) - addressed in versions 1.0.2-4.redhat_00005.1.el8eap, 1.0.2-4.redhat_00005.1.el9eap
eap8-reactive-streams (Red Hat package) - addressed in versions 1.0.4-2.redhat_00003.1.el8eap, 1.0.4-2.redhat_00003.1.el9eap
eap8-fge-msg-simple (Red Hat package) - addressed in versions 1.1.0-2.redhat_00015.1.el8eap, 1.1.0-2.redhat_00015.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-log4j2-jboss-logmanager (Red Hat package) - addressed in versions 1.1.2-1.Final_redhat_00002.1.el8eap, 1.1.2-1.Final_redhat_00002.1.el9eap
eap8-jakarta-json (Red Hat package) - addressed in versions 1.1.6-4.redhat_00003.1.el8eap, 1.1.6-4.redhat_00003.1.el9eap
eap8-fge-btf (Red Hat package) - addressed in versions 1.2.0-2.redhat_00017.1.el8eap, 1.2.0-2.redhat_00017.1.el9eap
eap8-java-classmate (Red Hat package) - addressed in versions 1.5.1-2.redhat_00003.1.el8eap, 1.5.1-2.redhat_00003.1.el9eap
eap8-wsdl4j (Red Hat package) - addressed in versions 1.6.3-4.redhat_00007.1.el8eap, 1.6.3-4.redhat_00007.1.el9eap
eap8-jasypt (Red Hat package) - addressed in versions 1.9.3-3.redhat_00003.1.el8eap, 1.9.3-3.redhat_00003.1.el9eap
eap8-apache-commons-beanutils (Red Hat package) - addressed in versions 1.9.4-12.redhat_00003.1.el8eap, 1.9.4-12.redhat_00003.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.15.0-5.redhat_00015.1.el8eap, 1.15.0-5.redhat_00015.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.0.0-2.redhat_00012.1.el8eap, 2.0.0-2.redhat_00012.1.el9eap
eap8-atinject (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-angus-activation (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-jakarta-transaction-api (Red Hat package) - addressed in versions 2.0.1-3.redhat_00004.1.el8eap, 2.0.1-3.redhat_00004.1.el9eap
eap8-jgroups-kubernetes (Red Hat package) - addressed in versions 2.0.2-1.Final_redhat_00001.1.el8eap, 2.0.2-1.Final_redhat_00001.1.el9eap
eap8-angus (Red Hat package) - addressed in versions 2.0.2-3.redhat_00002.1.el8eap, 2.0.2-3.redhat_00002.1.el9eap
eap8-wildfly-http-client (Red Hat package) - addressed in versions 2.0.7-1.Final_redhat_00001.1.el8eap, 2.0.7-1.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.7-3.redhat_00003.1.el8eap, 2.0.7-3.redhat_00003.1.el9eap
eap8-jakarta-interceptor-api (Red Hat package) - addressed in versions 2.1.0-4.redhat_00002.1.el8eap, 2.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-batch-api (Red Hat package) - addressed in versions 2.1.1-3.redhat_00003.1.el8eap, 2.1.1-3.redhat_00003.1.el9eap
eap8-jakarta-annotation-api (Red Hat package) - addressed in versions 2.1.1-4.redhat_00003.1.el8eap, 2.1.1-4.redhat_00003.1.el9eap
eap8-jakarta-mail (Red Hat package) - addressed in versions 2.1.2-2.redhat_00003.1.el8eap, 2.1.2-2.redhat_00003.1.el9eap
eap8-jakarta-activation (Red Hat package) - addressed in versions 2.1.2-2.redhat_00005.1.el8eap, 2.1.2-2.redhat_00005.1.el9eap
eap8-jakarta-json-api (Red Hat package) - addressed in versions 2.1.2-3.redhat_00003.1.el8eap, 2.1.2-3.redhat_00003.1.el9eap
eap8-jberet (Red Hat package) - addressed in versions 2.1.4-1.Final_redhat_00001.1.el8eap, 2.1.4-1.Final_redhat_00001.1.el9eap
eap8-jboss-modules (Red Hat package) - addressed in versions 2.1.4-2.Final_redhat_00001.1.el8eap, 2.1.4-2.Final_redhat_00001.1.el9eap
eap8-wildfly-elytron (Red Hat package) - addressed in versions 2.2.4-2.SP01_redhat_00001.1.el8eap, 2.2.4-2.SP01_redhat_00001.1.el9eap
eap8-ws-commons-XmlSchema (Red Hat package) - addressed in versions 2.3.0-2.redhat_00002.1.el8eap, 2.3.0-2.redhat_00002.1.el9eap
eap8-velocity (Red Hat package) - addressed in versions 2.3.0-2.redhat_00008.1.el8eap, 2.3.0-2.redhat_00008.1.el9eap
eap8-gson (Red Hat package) - addressed in versions 2.8.9-2.redhat_00002.1.el8eap, 2.8.9-2.redhat_00002.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.11.0-2.redhat_00003.1.el8eap, 2.11.0-2.redhat_00003.1.el9eap
eap8-apache-sshd (Red Hat package) - addressed in versions 2.12.1-1.redhat_00001.1.el8eap, 2.12.1-1.redhat_00001.1.el9eap
eap8-joda-time (Red Hat package) - addressed in versions 2.12.5-1.redhat_00001.1.el8eap, 2.12.5-1.redhat_00001.1.el9eap
eap8-jackson-annotations (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-java8 (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-databind (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-core (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-dataformats-binary (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-base (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.21.0-4.redhat_00048.1.el8eap, 2.21.0-4.redhat_00048.1.el9eap
eap8-wss4j (Red Hat package) - addressed in versions 3.0.1-2.redhat_00014.1.el8eap, 3.0.1-2.redhat_00014.1.el9eap
eap8-jakarta-validation-api (Red Hat package) - addressed in versions 3.0.2-2.redhat_00005.1.el8eap, 3.0.2-2.redhat_00005.1.el9eap
eap8-yasson (Red Hat package) - addressed in versions 3.0.3-2.redhat_00001.1.el8eap, 3.0.3-2.redhat_00001.1.el9eap
eap8-wildfly-transaction-client (Red Hat package) - addressed in versions 3.0.5-1.Final_redhat_00001.1.el8eap, 3.0.5-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar (Red Hat package) - addressed in versions 3.0.8-1.Final_redhat_00001.1.el8eap, 3.0.8-1.Final_redhat_00001.1.el9eap
eap8-javaee-jpa-spec (Red Hat package) - addressed in versions 3.1.0-3.redhat_00002.1.el8eap, 3.1.0-3.redhat_00002.1.el9eap
eap8-jakarta-ws-rs-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00002.1.el8eap, 3.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-jms-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00003.1.el8eap, 3.1.0-4.redhat_00003.1.el9eap
eap8-caffeine (Red Hat package) - addressed in versions 3.1.8-1.redhat_00001.1.el8eap, 3.1.8-1.redhat_00001.1.el9eap
eap8-hal-console (Red Hat package) - addressed in versions 3.6.18-1.Final_redhat_00001.1.el8eap, 3.6.18-1.Final_redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.0-2.redhat_00002.1.el8eap, 4.0.0-2.redhat_00002.1.el9eap
eap8-jakarta-xml-bind-api (Red Hat package) - addressed in versions 4.0.0-4.redhat_00009.1.el8eap, 4.0.0-4.redhat_00009.1.el9eap
eap8-elytron-web (Red Hat package) - addressed in versions 4.0.1-1.Final_redhat_00001.1.el8eap, 4.0.1-1.Final_redhat_00001.1.el9eap
eap8-jaxb (Red Hat package) - addressed in versions 4.0.2-4.redhat_00001.1.el8eap, 4.0.2-4.redhat_00001.1.el9eap
eap8-sun-istack-commons (Red Hat package) - addressed in versions 4.1.2-1.redhat_00003.1.el8eap, 4.1.2-1.redhat_00003.1.el9eap
eap8-httpcomponents-asyncclient (Red Hat package) - addressed in versions 4.1.5-2.redhat_00004.1.el8eap, 4.1.5-2.redhat_00004.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.100-2.Final_redhat_00001.1.el8eap, 4.1.100-2.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.100-5.Final_redhat_00001.1.el8eap, 4.1.100-5.Final_redhat_00001.1.el9eap
eap8-stax2-api (Red Hat package) - addressed in versions 4.2.1-2.redhat_00008.1.el8eap, 4.2.1-2.redhat_00008.1.el9eap
eap8-httpcomponents-core (Red Hat package) - addressed in versions 4.4.16-2.redhat_00008.1.el8eap, 4.4.16-2.redhat_00008.1.el9eap
eap8-httpcomponents-client (Red Hat package) - addressed in versions 4.5.14-2.redhat_00010.1.el8eap, 4.5.14-2.redhat_00010.1.el9eap
eap8-protostream (Red Hat package) - addressed in versions 4.6.5-4.Final_redhat_00006.1.el8eap, 4.6.5-4.Final_redhat_00006.1.el9eap
eap8-antlr4 (Red Hat package) - addressed in versions 4.10.1-1.redhat_00001.1.el8eap, 4.10.1-1.redhat_00001.1.el9eap
eap8-jboss-ejb-client (Red Hat package) - addressed in versions 5.0.6-1.Final_redhat_00001.1.el8eap, 5.0.6-1.Final_redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - addressed in versions 5.2.23-1.Final_redhat_00001.1.el8eap, 5.2.23-1.Final_redhat_00001.1.el9eap
eap8-jakarta-servlet-api (Red Hat package) - addressed in versions 6.0.0-4.redhat_00005.1.el8eap, 6.0.0-4.redhat_00005.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.2-1.Final_redhat_00002.1.el8eap, 6.0.2-1.Final_redhat_00002.1.el9eap
eap8-hibernate-search (Red Hat package) - addressed in versions 6.2.2-1.Final_redhat_00001.1.el8eap, 6.2.2-1.Final_redhat_00001.1.el9eap
eap8-resteasy (Red Hat package) - addressed in versions 6.2.7-1.Final_redhat_00001.1.el8eap, 6.2.7-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.18-1.Final_redhat_00001.1.el8eap, 6.2.18-1.Final_redhat_00001.1.el9eap
eap8-woodstox-core (Red Hat package) - addressed in versions 6.4.0-2.redhat_00002.1.el8eap, 6.4.0-2.redhat_00002.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-1.Final_redhat_00001.1.el8eap, 8.0.1-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.2-2.GA_redhat_00009.1.el8eap, 8.0.2-2.GA_redhat_00009.1.el9eap
eap8-lucene-solr (Red Hat package) - addressed in versions 8.11.3-1.redhat_00001.1.el8eap, 8.11.3-1.redhat_00001.1.el9eap
eap8-infinispan (Red Hat package) - addressed in versions 14.0.24-1.Final_redhat_00001.1.el8eap, 14.0.24-1.Final_redhat_00001.1.el9eap
eap8-guava-libraries (Red Hat package) - addressed in versions 32.1.2-1.jre_redhat_00001.1.el8eap, 32.1.2-1.jre_redhat_00001.1.el9eap

• https://access.redhat.com/security/cve/CVE-2024-1102
• https://bugzilla.redhat.com/show_bug.cgi?id=2262060
• https://github.com/jberet/jsr352/issues/452
• https://access.redhat.com/errata/RHSA-2024:3580
• https://access.redhat.com/errata/RHSA-2024:3581
• https://access.redhat.com/errata/RHSA-2024:3583

• Information disclosure in JBeret jsr352
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8