PT-2020-16144 · Red Hat · Wildfly

Jiridaneko · Published 2020-11-24 · Updated 2024-03-06 · CVE-2020-25640

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WildFly versions prior to 21.0.0.Final

Description A flaw was discovered in WildFly where the resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Recommendations For versions prior to 21.0.0.Final, update to version 21.0.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of sensitive information exposure.

Fix

Insertion into Log File

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-532

CWE-209

Related Identifiers

BIT-WILDFLY-2020-25640

CVE-2020-25640

GHSA-JW3V-5CH2-WFMM

RHSA-2021:0246

RHSA-2021:0247

RHSA-2021:0248

Affected Products

Wildfly

References · 10

• https://bugzilla.redhat.com/show_bug.cgi?id=1881637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25640 · Security Note
• https://osv.dev/vulnerability/BIT-wildfly-2020-25640 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jw3v-5ch2-wfmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25640 · Vendor Advisory
• https://github.com/amqphub/amqp-10-resource-adapter/issues/13 · Note
• https://security.netapp.com/advisory/ntap-20201210-0001 · Note
• https://t.me/cvenotify/6145 · Telegram Post
• https://t.me/cvenotify/6162 · Telegram Post
• https://t.me/cibsecurity/16809 · Telegram Post