A flaw was found in Red Hats AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
Weakness
The product stores sensitive information in cleartext in a file, or on disk.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jboss_a-mq | Redhat | 7 (including) | 7 (including) |
| Jboss_middleware | Redhat | 1 (including) | 1 (including) |
| RHEL-8 based Middleware Containers | RedHat | amq7/amq-broker-rhel8-operator:7.11.1-9 | * |
| RHEL-8 based Middleware Containers | RedHat | amq7/amq-broker-rhel8-operator-bundle:7.11.1-12 | * |
References
- https://access.redhat.com/errata/RHSA-2023:4720
- https://access.redhat.com/security/cve/CVE-2023-4066
- https://bugzilla.redhat.com/show_bug.cgi?id=2224677
- https://access.redhat.com/errata/RHSA-2023:4720
- https://access.redhat.com/security/cve/CVE-2023-4066
- https://bugzilla.redhat.com/show_bug.cgi?id=2224677