CVE-2024-0006 | THREATINT

Assigner	Yugabyte
Reserved	2023-11-07
Published	2024-07-19
Updated	2024-08-01

Description

Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.

MEDIUM: 5.4

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Problem types

CWE-532 Insertion of Sensitive Information into Log File

Product status

Default status

unaffected

2.18.0.0 before 2.18.9.0

affected

2.20.0.0 before 2.20.2.3

affected

2024.0.0.0 before 2024.1.1.0

affected

References

https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593 patch

https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579 patch

https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2 patch

cve.org CVE-2024-0006

nvd.nist.gov CVE-2024-0006

Download JSON