Apache ActiveMQ Artemis Sensitive Information Logging Vulnerability

A vulnerability allowing the unintentional logging of sensitive information has been identified in Apache ActiveMQ Artemis versions 1.5.1 prior to 2.40.0. When the logger for 'org.apache.activemq.artemis.core.config.impl.ConfigurationImpl' is set to debug level, all broker property values are recorded in the log. This issue can be mitigated by limiting log access to trusted users.

Impact

Exposed sensitive information in log files, potentially including passwords.

Remediation

Users are advised to upgrade to Apache ActiveMQ Artemis version 2.40.0 or later, which addresses this vulnerability. Additionally, log access should be restricted to trusted users.