PT-2024-15291 · Yugabyte · Yugabyte Platform

Published 2024-07-19 · Updated 2024-07-22 · CVE-2024-0006

Positive Technologies (AI Summary)

CVSS v4.0

5.4

Medium

Base vector

AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Yugabyte Platform (affected versions not specified)

Description The issue concerns information exposure in the logging system, allowing local attackers with access to application logs to obtain database user credentials in log files. This could potentially lead to unauthorized database access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-0006

Affected Products

Yugabyte Platform

References · 8

• https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579 · Patch
• https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2 · Patch
• https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593 · Patch
• https://osv.dev/vulnerability/CVE-2024-0006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0006 · Security Note
• https://t.me/cvenotify/87017 · Telegram Post
• https://t.me/cvenotify/86762 · Telegram Post
• https://t.me/cvedetector/1220 · Telegram Post