GHSA-5gj6-62g7-vmgf
Hazelcast vulnerable to unmasked password exposure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.hazelcast:hazelcast | >= 4.0-BETA-1, <= 4.2.8 | no fix listed |
| Maven | com.hazelcast:hazelcast | >= 5.0-BETA-1, < 5.0.5 | 5.0.5 |
| Maven | com.hazelcast:hazelcast | >= 5.1-BETA-1, < 5.1.6 | 5.1.6 |
| Maven | com.hazelcast:hazelcast | >= 5.2-BETA-1, < 5.2.4 | 5.2.4 |
| Maven | com.hazelcast:hazelcast | >= 5.3.0-BETA-1, < 5.3.0 | 5.3.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-33264
- https://github.com/hazelcast/hazelcast/pull/24266
- https://github.com/hazelcast/hazelcast/pull/24266/commits/80a502d53cc48bf895711ab55f95e3a51e344ac1
- https://github.com/hazelcast/hazelcast/commit/74eed86c2b2b727148c442e98a01d0ca6941a49e
- https://github.com/hazelcast/hazelcast