[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a1d7fb19-0a89-d1dc-e949-53bd626291e4@apache.org>
Date: Thu, 30 Oct 2025 15:13:16 +0000
From: Ashish Tiwari <ashishtiwari@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-62232: Apache APISIX: APISIX basic-auth logs plaintext
credentials at info level
Severity: moderate
Affected versions:
- Apache APISIX 1.0
Description:
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.
It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629
Users are recommended to upgrade to version 3.14, which fixes this issue.
References:
https://apisix.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-62232
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
