GHSA-j6hh-h3cf-c2hf
Spring Cloud Config Server Logged Sensitive Information
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 3.1.0, <= 3.1.13 | no fix listed |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.1.0, <= 4.1.9 | no fix listed |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.2.0, <= 4.2.6 | no fix listed |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.3.0, < 4.3.3 | 4.3.3 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 5.0.0, < 5.0.3 | 5.0.3 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 3.0.0, <= 3.0.7 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
References
External links from the advisory. They lead to third-party sites.