GHSA-7wq4-89xx-g62j

Password exposure in ShenYu

Source: GitHub Advisory Database (reviewed) High CVE-2022-23223

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.shenyu:shenyu-common	>= 2.4.0, < 2.4.2	2.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23223 advisory
https://github.com/apache/shenyu/pull/2357 web
https://github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654 web
https://github.com/apache/incubator-shenyu web
https://github.com/apache/incubator-shenyu/releases/tag/v2.4.2 web
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s web
http://www.openwall.com/lists/oss-security/2022/01/25/7 web
http://www.openwall.com/lists/oss-security/2022/01/26/4 web