CVE-2021-34797CWE-532

CVE-2021-34797: vulnerability in Apache Geode

Apache Geode project log file redaction of sensitive information vulnerability

Published · Updated

Follow this CVE+ Monitor Apache Geode+ Monitor org.apache.geode:geode-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.6%
Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
Affected products
Apache Software Foundation · Apache Geode
Related CVEs — Apache Geode

In the same product, most dangerous first.

CVE-2017-15692—CVE-2017-15692EPSS 4.8%CVE-2017-9795—CVE-2017-9795EPSS 4.2%CVE-2017-5649—CVE-2017-5649EPSS 2.8%CVE-2022-37021—Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.EPSS 2.6%CVE-2017-15695—CVE-2017-15695EPSS 2.5%CVE-2017-15693—CVE-2017-15693EPSS 2.5%