[JBoss JIRA] (WFCORE-885) World readable audit.log file
- First Post
- Replies
- Stats
-
Go to
- ----- 2026 -----
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
[
https://issues.jboss.org/browse/WFCORE-885?page=com.atlassian.jira.plugin...
]
Ivo Studensky updated WFCORE-885:
---------------------------------
Component/s: Domain Management
(was: Security)
Git Pull Request: https://github.com/wildfly/wildfly-core/pull/1023
I've prepared a port of Peter's commit to WildFly Core.
As the current audit log code looks differently to EAP, it has to be a bit restructured.
World readable audit.log file
-----------------------------
Key: WFCORE-885
URL: https://issues.jboss.org/browse/WFCORE-885
Project: WildFly Core
Issue Type: Bug
Components: Domain Management
Affects Versions: 2.0.0.Beta2
Reporter: Ondrej Lukas
Assignee: Brian Stansberry
Priority: Blocker
Server logs sensitive information into a world readable audit.log file. This information
could be used by a local attacker to gain otherwise protected information about user
sessions etc.
This issue was originally reported as CVE in
https://bugzilla.redhat.com/show_bug.cgi?id=1063642. EAP 6.x branches are fixed but same
issue occurs in EAP 7 again.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
4011
days inactive
4011
days old
0 comments
1 participants
tags (0)
participants (1)
-
Ivo Studensky (JIRA)