[KARAF-4200] Privacy Violation: Heap Inspection

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 4.0.3
• Assignee: Unassigned
• Reporter: Eduardo Aguinaga
• Created: 15/Dec/15 15:06
• Updated: 28/Jan/17 05:07
• Resolved: 28/Jan/17 05:07

Description

HP Fortify and SciTools Understand were used to perform an application security scan on the karaf source code.

The method login() in JDBCLoginModule.java stores sensitive data in a String object on line 95, making it impossible to reliably purge the data from memory.

JDBCLoginModule.java, lines 88-96:

88 user = ((NameCallback) callbacks[0]).getName();
89 
90 char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
91 if (tmpPassword == null) {
92     tmpPassword = new char[0];
93 }
94 
95 String password = new String(tmpPassword);
96 principals = new HashSet<>();

Issue Links

• is related to: KARAF-4199 Privacy Violation: Heap Inspection