A vulnerability was found in Quarkus CXF. The issue is that passwords and other secrets may appear in the application log in spite of the user has configured them to be hidden. All of the following conditions need to be met: 1. SOAP message logging is enabled via any of the properties (see https://docs.quarkiverse.io/quarkus-cxf/3.15/reference/extensions/quarkus-cxf.html#quarkus-cxf_quarkus-cxf-logging-enabled-for ) * quarkus.cxf.logging.enabled-for * quarkus.cxf.endpoint."/endpoint-path".logging.enabled * quarkus.cxf.client."client-name".logging.enabled 2. The application sets any of the following configuration properties: * quarkus.cxf.endpoint."/endpoint-path".logging.sensitive-element-names * quarkus.cxf.endpoint."/endpoint-path".logging.sensitive-protocol-header-names * quarkus.cxf.client."client-name".logging.sensitive-element-names * quarkus.cxf.client."client-name".logging.sensitive-protocol-header-names 3. The attacker has an access to the application log
This issue has been addressed in the following products: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 Via RHSA-2024:10035 https://access.redhat.com/errata/RHSA-2024:10035