[
https://issues.apache.org/jira/browse/MTOMCAT-323?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17280273#comment-17280273
]
Mark Thomas commented on MTOMCAT-323:
-------------------------------------
In my astonishment I forgot to mention that potential security vulnerability
reports should *NEVER* be reported via a public bug tracker. Instructions for
the correct process may be found at: [http://www.apache.org/security/]
> Avoid using plaintext Keystore password in source code
> --------------------------------------------------------
>
> Key: MTOMCAT-323
> URL: https://issues.apache.org/jira/browse/MTOMCAT-323
> Project: Apache Tomcat Maven Plugin
> Issue Type: Improvement
> Reporter: Ying Zhang
> Priority: Major
>
> We are a security research team at Virginia Tech. We are doing an empirical
> study about the usefulness of the existing security vulnerability detection
> tools. The following is a reported vulnerability by certain tools. We'll so
> appreciate it if you can give any feedback on it.
> *Vulnerability Description*
> In file tomcat/test/org/apache/tomcat/util/net/TesterSupport.java, use hard
> code password at Line 179.
> *Security Impact:*
> Keystore password should not be kept in the source code. The source code can
> be widely shared in an enterprise environment, and is certainly shared in
> open source. The product transmits or stores authentication credentials, but
> it uses an insecure way that is susceptible to unauthorized interception
> and/or retrieval. We understand it is in the TestSupport file, but should it
> at least give some "reminder" to users for avoiding the misuses
> *Useful Resources*:
> [https://cwe.mitre.org/data/definitions/321.html]
> [https://cwe.mitre.org/data/definitions/522.html]
> [https://www.baeldung.com/java-keystore]
> *Solution we suggest*
> To be managed safely, passwords or secret keys should be stored in separate
> configuration files or keystores. The Keystore password is better to load
> from the locally set files instead of directly set in the code.
> *Please share with us your opinions/comments if there is any*
> Is the bug report helpful?
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
