The fabric-chaincode-java component of Hyperledger Fabric, in versions 2.3.1 through 2.5.9, logs the TLS private key password in plaintext within INFO level logs when operating in chaincode-as-a-service mode with TLS enabled. This exposure of sensitive information (CWE-532) allows an attacker with access to the logs to retrieve the TLS private key password. Combined with possession of the TLS private key, this could enable impersonation of the chaincode server. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting a medium severity. The issue was fixed in version 2.5.10.

Disclosure of the TLS private key password in logs can lead to compromise of the TLS private key if an attacker obtains both the password and the key. This enables impersonation of the chaincode server, potentially undermining the integrity of communications. The vulnerability does not affect confidentiality, integrity, or availability directly beyond this credential exposure. No known exploits are reported in the wild.

Upgrade fabric-chaincode-java to version 2.5.10 or later, where this issue is patched. Until upgrading, restrict access to chaincode server logs to trusted personnel only to prevent exposure of the TLS private key password. Patch status is confirmed by the vendor advisory indicating the fix in version 2.5.10.