Brocade SANnav Password and Key Logging Vulnerability in Audit Logs

A vulnerability exists in Brocade SANnav versions prior to 2.4.0a, where passwords and PBE keys are logged in the server's audit logs under certain conditions. This issue affects both standard and OVA deployments of SANnav. The logged information includes security passwords, database passwords, and PBE keys during disaster recovery setups between SANnav servers. These audit logs are only accessible to the server admin of the host server, not to SANnav admins or users.

Impact

The vulnerability leads to the cleartext logging of sensitive information, including passwords and cryptographic keys, in audit logs that are accessible only to the host server's admin.

Remediation

Users can upgrade to Brocade SANnav version 2.4.0a to address this vulnerability.