title: Plaintext password in operator log
description: A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
problem types: Improper Output Neutralization for Logs
affected:
{
product: Red
vendor: n/a
versions:
version: Hat AMQ Broker 7.11.1.OPR.2.GA, status: unaffected
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: amq7/amq-broker-rhel8-operator
defaultStatus: affected
versions:
version: 7.11.1-9, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: amq7/amq-broker-rhel8-operator-bundle
defaultStatus: affected
versions:
version: 7.11.1-12, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ 7
collectionURL: https://catalog.redhat.com/software/containers/
packageName: amq-broker-operator-container
defaultStatus: affected
cpes: cpe:/a:redhat:amq_broker:7
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]