An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a maxctrl create service command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Maxscale | Mariadb | * | 2.5.28 (excluding) |
| Maxscale | Mariadb | 6.0.0 (including) | 6.4.9 (excluding) |
| Maxscale | Mariadb | 22.08 (including) | 22.08.8 (excluding) |
| Maxscale | Mariadb | 23.02 (including) | 23.02.3 (excluding) |