Bug 1770615 (CVE-2019-14885) - CVE-2019-14885 JBoss EAP: Vault system property security attribute value is revealed on CLI 'reload' command
Summary: CVE-2019-14885 JBoss EAP: Vault system property security attribute value is r...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14885
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1767088
Blocks: 1766523
TreeView+ depends on / blocked
 
Reported: 2019-11-11 00:22 UTC by Kunjan Rathod
Modified: 2020-03-23 20:13 UTC (History)
37 users (show)

Fixed In Version: JBoss EAP 7.2.6.GA
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the JBoss EAP Vault system. Confidential information of the system property’s security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information.
Clone Of:
Environment:
Last Closed: 2020-01-21 08:10:05 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:0159 None None None 2020-01-21 02:56:42 UTC
Red Hat Product Errata RHSA-2020:0160 None None None 2020-01-21 03:46:52 UTC
Red Hat Product Errata RHSA-2020:0161 None None None 2020-01-21 03:22:04 UTC
Red Hat Product Errata RHSA-2020:0164 None None None 2020-01-21 02:24:10 UTC
Red Hat Product Errata RHSA-2020:0951 None None None 2020-03-23 20:13:55 UTC

Description Kunjan Rathod 2019-11-11 00:22:12 UTC
It was found that the JBoss EAP Vault system property's security attribute value is revealed in the JBoss EAP's log file, when executing a JBoss CLI's 'reload' command which leads to exposing a confidential information.

Comment 5 errata-xmlrpc 2020-01-21 02:24:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:0164 https://access.redhat.com/errata/RHSA-2020:0164

Comment 6 errata-xmlrpc 2020-01-21 02:56:40 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:0159 https://access.redhat.com/errata/RHSA-2020:0159

Comment 7 errata-xmlrpc 2020-01-21 03:22:02 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:0161 https://access.redhat.com/errata/RHSA-2020:0161

Comment 8 errata-xmlrpc 2020-01-21 03:46:50 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:0160 https://access.redhat.com/errata/RHSA-2020:0160

Comment 9 Product Security DevOps Team 2020-01-21 08:10:05 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14885

Comment 14 errata-xmlrpc 2020-03-23 20:13:52 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2020:0951 https://access.redhat.com/errata/RHSA-2020:0951


Note You need to log in before you can comment on or make changes to this bug.