CODEWITHSUNDEEP
rabbitmqveracode
Mario
Mario

Reputation: 73

Fixing CWE ID 117 in Rabbitmq client Library

My software uses RabbitMQ for communication. However, Veracode has flagged CWE 117 (Improper output neutralization for logs) from the amqp-client library.

enter image description here

I have tried to upgrade to the latest version (4.11.3), but Veracode still does not let me pass. I cannot upgrade further as my software are written in Java 7, and the client do not have any plans to upgrade to Java 8.

Is there any things I can do in my software code to get rid of CWE 117 issue?

Upvotes: 0

Views: 196

Answers (1)

Michael Klishin
Michael Klishin

Reputation: 786

The lines in question log peer certificate chain information when peer verification fails, at DEBUG level. I don't think it poses any practical risk as most applications do not run with debug logging enabled. In any case, mitigation is as easy as using a more restrictive log level, e.g. INFO.

Upvotes: 1

Related Questions