CVE-2020-1940: Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
Summary
CVE-2020-1940: Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak. Affects org.apache.jackrabbit:oak-core across 2 version ranges.
>= 1.10.0, < 1.10.8
>= 1.12.0, < 1.24.0
Fixed in 1.10.8 or 1.24.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Jackrabbit Oak is an open-source content repository implementation that provides support for hierarchical content storage. It is widely used in Java applications for managing structured and unstructured data. The vulnerability identified as CVE-2020-1940 affects versions 1.2.0 to 1.22.0 of Apache Jackrabbit Oak. This vulnerability is related to the optional initial password change and password expiration features present in the software.
Vulnerability Detail
The vulnerability arises from an improper removal of sensitive information during the authentication process. When a user changes their password for the first time, the new password is passed as an additional attribute to the credentials object. However, the code fails to remove this sensitive information after processing it during the first phase of authentication. This flaw, when combined with other independent authentication mechanisms, can potentially lead to the disclosure of the new password.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.10.0, < 1.10.81.10.8 -
>= 1.12.0, < 1.24.01.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the optional initial password change and password expiration features in Apache Jackrabbit Oak. This can be achieved by modifying the configuration settings to remove or comment out the relevant code responsible for these features. However, it is important to note that this workaround may impact the functionality and security of the application, and it is recommended to apply the official fix by upgrading to a fixed version.
Conclusion
In conclusion, CVE-2020-1940 is a vulnerability in Apache Jackrabbit Oak that allows for the improper removal of sensitive information during the authentication process. This can potentially lead to the disclosure of a user's new password. Users are advised to upgrade to version 1.24.0 or later to mitigate this vulnerability. Alternatively, a temporary workaround is available by disabling the optional features. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jackrabbit:oak-core →
FAQ
Apache Jackrabbit Oak is an open-source content repository implementation used for managing structured and unstructured data in Java applications.
Versions 1.2.0 to 1.22.0 of Apache Jackrabbit Oak are affected by this vulnerability.
This vulnerability can potentially lead to the disclosure of a user's new password if combined with other independent authentication mechanisms.
To fix this vulnerability, it is recommended to upgrade to Apache Jackrabbit Oak version 1.24.0 or later.
Yes, users can disable the optional initial password change and password expiration features in Apache Jackrabbit Oak as a temporary workaround.
