{"id":"CVE-2021-34797","aliases":["EUVD-2022-0653","GHSA-mw25-f5r2-hpc6"],"status":"published","title":"Apache Geode project log file redaction of sensitive information vulnerability","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02597,"percentile":0.85463,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-01-04T08:55:20Z","modified":"2026-10-24T10:30:32Z","fixes":[{"ecosystem":"Maven","package":"org.apache.geode:geode-core","fixed_in":["1.12.5","1.13.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5"}]}],"versions":["1.0.0-incubating","1.0.0-incubating.M2","1.0.0-incubating.M3","1.1.0","1.1.1","1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.5"}]}],"versions":["1.13.0","1.13.1","1.13.2","1.13.3","1.13.4"]}],"products":[{"vendor":"apache","product":"geode"},{"vendor":"apache software foundation","product":"apache geode"}],"references":[{"url":"https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34797","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mw25-f5r2-hpc6"},{"url":"https://github.com/apache/geode","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-34797","title":"Apache Geode project log file redaction of sensitive information vulnerability","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-04T08:55:20Z","modified":"2024-08-04T00:26:54.012Z","cwes":["CWE-532"],"updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2022-0653","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-04T08:55:20Z","modified":"2024-08-04T00:26:54Z","updated_at":"2026-11-03T03:24:31.977228Z"}],"ghsa":[{"id":"GHSA-mw25-f5r2-hpc6","title":"Insertion of Sensitive Information into Log File in Apache Geode","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-06T22:23:25Z","modified":"2023-02-03T05:03:55Z","cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:41.967989Z"}],"nvd":[{"id":"CVE-2021-34797","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-04T09:15:07.127Z","modified":"2026-06-17T03:56:35.473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"CVE-2021-34797","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-04T09:15:07.127Z","modified":"2026-10-24T10:30:32.319842087Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"GHSA-mw25-f5r2-hpc6","title":"Insertion of Sensitive Information into Log File in Apache Geode","description":"Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.","status":"published","published":"2022-01-06T22:23:25Z","modified":"2024-12-04T05:33:25.245716Z","cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}