CVE-2024-11193: 
YugabyteDB vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2024-11193) was discovered in Yugabyte Anywhere, affecting versions from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, and from 2024.1.0.0 before 2024.1.3.0. The vulnerability involves the exposure of LDAP bind passwords in plaintext within application logs (NVD).

The vulnerability stems from a logging issue where the LDAP bind password is logged in plaintext within Yugabyte Anywhere application logs. This occurs specifically when logging the value of ysql_hba_conf_csv during Gflags operations. The vulnerability has been assigned a CVSS v4.0 score of 5.0 (Medium) with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H (NVD).

The vulnerability allows unauthorized users with access to application logs to view the LDAP bind password. This exposure could lead to unauthorized access to the LDAP server, potentially resulting in the compromise of LDAP-managed resources (NVD).

The vulnerability requires an attacker to have access to the application logs to exploit the issue. The attack complexity is considered high, as indicated by the CVSS score, and requires high privileges to access the logs (NVD).

A fix has been implemented to redact the ysql_hba_conf_csv value from logs during Gflags operations. The fix is available in versions 2.20.7.0, 2.23.1.0, and 2024.1.3.0 or later (GitHub Commit).