Brocade SANnav Plaintext Passphrase Logging Vulnerability

A vulnerability exists in Brocade SANnav versions prior to 2.4.0a, where plaintext passphrases are logged in the host server's audit logs. This occurs when the OpenSSL command is executed with a passphrase provided via the command line or through a temporary file. These audit logs are local to the server VM and are not managed by SANnav. They can only be accessed by the server administrator and are not visible to SANnav administrators or users.

Impact

Logging of plaintext passphrases in audit logs, potentially leading to unauthorized access if the logs are accessed by an unauthorized user.

Remediation

Users can upgrade to Brocade SANnav version 2.4.0a to address this vulnerability.