PT-2018-4627 · Oracle · Mysql Server

Published 2018-03-29 · Updated 2021-09-09 · CVE-2016-0898

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MySQL for PCF tiles versions 1.7.x before 1.7.10

Description A issue was discovered where the AWS access key is logged in plaintext. These credentials are logged to the Service Backup component logs, not the system log, and are not exposed outside the Service Backup VM.

Recommendations For versions 1.7.x before 1.7.10, update to version 1.7.10 or later to prevent the AWS access key from being logged in plaintext.

Fix

Insertion into Log File

Weakness Enumeration

CWE-255

CWE-532

Related Identifiers

CVE-2016-0898

Affected Products

Mysql Server

References · 4

• https://pivotal.io/security/cve-2016-0898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0898 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0898 · Vendor Advisory
• http://securityfocus.com/bid/95146 · Note