Bug 2317130 (CVE-2024-9621)

Summary:	CVE-2024-9621 io.quarkiverse.cxf:quarkus-cxf: Quarkus CXF may log user password and secret to application log
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	chazlett, fmongiar, janstey, jnethert
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-10-08 01:11:04 UTC

A vulnerability was found in Quarkus CXF. The issue is that passwords and other secrets may appear in the  application log in spite of the user has configured them to be hidden.

All of the following conditions need to be met:

1. SOAP message logging is enabled via any of the properties (see
https://docs.quarkiverse.io/quarkus-cxf/3.15/reference/extensions/quarkus-cxf.html#quarkus-cxf_quarkus-cxf-logging-enabled-for
)

* quarkus.cxf.logging.enabled-for
* quarkus.cxf.endpoint."/endpoint-path".logging.enabled
* quarkus.cxf.client."client-name".logging.enabled

2. The application sets any of the following configuration properties:

* quarkus.cxf.endpoint."/endpoint-path".logging.sensitive-element-names
* quarkus.cxf.endpoint."/endpoint-path".logging.sensitive-protocol-header-names
* quarkus.cxf.client."client-name".logging.sensitive-element-names
* quarkus.cxf.client."client-name".logging.sensitive-protocol-header-names

3. The attacker has an access to the application log

Comment 1 errata-xmlrpc 2024-11-19 21:20:20 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.4 for Quarkus 3.8

Via RHSA-2024:10035 https://access.redhat.com/errata/RHSA-2024:10035