Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-16238

CVE-2022-1278: Unconfigured MP OpenTracing may leak sensitive details

    XMLWordPrintable

Details

    Description

      A community user is reporting this:

      so we finally upgraded our production server to Wilfdly 26.0.1
      In the log I get frequent "Error while flushing N spans" errors (at debug level)
      Is this something to worry about?
      This is the default standalone configuration, and I did not intent to use any such feature.
      Should I disable something, fix something, or just put the logger to Info level ?2022-03-30 17:08:09,041 {/} DEBUG org.wildfly.extension.microprofile.opentracing Error while flushing 1 spans
      2022-03-30 17:08:17,042 {/} DEBUG org.wildfly.extension.microprofile.opentracing Error while flushing 2 spans

      In galleon-pack/galleon-content/src/main/resources/feature_groups/standalone.xml, we see

      <feature-group name="microprofile-opentracing-jaeger"/> 

      This was  added by Emmanuel on 12/15/20 as part of WFLY-14148, so this been in the system for some time (so the user's upgraded-from-version is likely fairly old). It does strike me as odd that a MicroProfile subsystem is enabled in the standalone configuration.

      Per Darran's request, we need to determine if this is, indeed, correct, and, if not, fix it before 26.1 Final ships.

      Attachments

        Activity

          People

            jaslee@redhat.com Jason Lee
            jaslee@redhat.com Jason Lee
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: