Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-16238

CVE-2022-1278: Unconfigured MP OpenTracing may leak sensitive details

XMLWordPrintable

      A community user is reporting this:

      so we finally upgraded our production server to Wilfdly 26.0.1
      In the log I get frequent "Error while flushing N spans" errors (at debug level)
      Is this something to worry about?
      This is the default standalone configuration, and I did not intent to use any such feature.
      Should I disable something, fix something, or just put the logger to Info level ?2022-03-30 17:08:09,041 {/} DEBUG org.wildfly.extension.microprofile.opentracing Error while flushing 1 spans
      2022-03-30 17:08:17,042 {/} DEBUG org.wildfly.extension.microprofile.opentracing Error while flushing 2 spans

      In galleon-pack/galleon-content/src/main/resources/feature_groups/standalone.xml, we see

      <feature-group name="microprofile-opentracing-jaeger"/> 

      This was  added by Emmanuel on 12/15/20 as part of WFLY-14148, so this been in the system for some time (so the user's upgraded-from-version is likely fairly old). It does strike me as odd that a MicroProfile subsystem is enabled in the standalone configuration.

      Per Darran's request, we need to determine if this is, indeed, correct, and, if not, fix it before 26.1 Final ships.

              jaslee@redhat.com Jason Lee
              jaslee@redhat.com Jason Lee
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: