同じ製品で同じ時期に公表された 8 件の脆弱性の 1 つです。まとめた解説: Apache Juneauに脆弱性、9.2.1で修正版が公開
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 修正版 |
|---|---|---|---|
| Apache Software Foundation | Apache Juneau |
9.2.1 未満 |
9.2.1 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
出典: oss-security (Openwall) NVD GitHub Advisory