CVE-2014-0085 Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse

What is CVE-2014-0085?

CVE-2014-0085 is a low-severity vulnerability in n/a, published on 17 Apr 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

Weakness: CWE-255

Which versions are affected by CVE-2014-0085?

2 open source packages ship an affected version, including org.jboss.fuse:jboss-fuse. It affects 2 products.

Products include Redhat Jboss A-Mq, Redhat Jboss Fuse.

How do I fix CVE-2014-0085?

Upgrade org.jboss.fuse:jboss-fuse to 6.1.0 or later.

Is CVE-2014-0085 being exploited?

There is no known exploitation of CVE-2014-0085 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-8648 Deserialization in Karaf High 7.2
• CVE-2020-14379 XML external entity in Red Hat AMQ Medium 5.6
• CVE-2023-4066 Operator: passwords defined in secrets shown in statefulset yaml Medium 5.5
• CVE-2023-4065 Operator: plaintext password in operator log Medium 5.5
• CVE-2015-5181 Cross-site scripting in n/a Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h259-3rjg-5qp3, UBUNTU-CVE-2014-0085.