CVE Database

CVE-2012-0034

Impact: Low
Public: 2011-12-30
Bugzilla: 772835: CVE-2012-0034 JBoss Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

Details

The MITRE CVE dictionary describes this issue as:

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.

Find out more about CVE-2012-0034 from the MITRE CVE dictionary and NIST NVD.

CVSS v2 metrics

Base Score: 1
Base Metrics: AV:L/AC:H/Au:S/C:P/I:N/A:N
Access Vector: Local
Access Complexity: High
Authentication: Single Instance
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat security errata

Platform Errata Release Date
JBoss Enterprise BRMS Platform 5.3 RHSA-2013:0221 January 31, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (jbossas) RHSA-2013:0193 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (jbossas) RHSA-2013:0192 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (jbossas) RHSA-2013:0191 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5.1 RHSA-2012:0108 February 10, 2012
Red Hat JBoss SOA Platform 5.3 RHSA-2013:0533 February 20, 2013
Red Hat JBoss Web Platform 5 for RHEL 4 AS (jbossas-web) RHSA-2013:0197 January 24, 2013
Red Hat JBoss Web Platform 5 for RHEL 5 Server (jbossas-web) RHSA-2013:0196 January 24, 2013
Red Hat JBoss Web Platform 5 for RHEL 6 Server (jbossas-web) RHSA-2013:0195 January 24, 2013
Red Hat JBoss Web Platform 5.1 RHSA-2012:1072 July 12, 2012

External References

This page is generated automatically and has not been checked for errors or omissions.

For clarification or corrections please contact the Red Hat Security Response Team.