Threats tagged 'ghsa-2987-fvqf-8g2j'

Apache Syncope versions 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a vulnerability where sensitive information is inserted into log files. This occurs when an AES key of non-standard length is configured, causing Syncope to pad the key with random characters and log the resulting key value. The issue is fixed in versions 4.0.8 and 4.1.3.