This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-3888 →

DEBIAN-CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors...

Original description

The description as published by the source.

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:14 undertow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.23-1"}]}]

References

advisory security-tracker.debian.org