Back

CRITICAL

undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files

Published Oct 2, 2019

Description

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Affected products

Remediation

Red Hat statement

All the Red Hat products using the undertow-core jar version 2.0.20 or before are affected.

Red Hat mitigation

Use Elytron instead of legacy Security subsystem.

Metrics

Weaknesses (1)

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Oct 2, 2019
Updated Aug 4, 2024
Reserved Mar 27, 2019
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Sep 30, 2019
GHSA-8VH8-VC28-M2HF