Veracode reports CWE 117 in peer certificate logging code

This issue has been reported on Stack Overflow: https://stackoverflow.com/q/57455162/11044402

• rabbitmq-java-client:4.11.3

Veracode reports

CWE 117 (Improper output neutralization for logs)

at lines

https://github.com/rabbitmq/rabbitmq-java-client/blob/v4.11.3/src/main/java/com/rabbitmq/client/impl/TlsUtils.java#L110

and

https://github.com/rabbitmq/rabbitmq-java-client/blob/v4.11.3/src/main/java/com/rabbitmq/client/impl/TlsUtils.java#L112

[michaelklishin]

Some relevant information that's missing from the issue:

• CWE-117
• @lutzhorn uses a legacy release series of the client because of a JDK 7 support requirement
• TlsUtils.java:110
• TlsUtils.java:112

The lines in question log peer certificate chain information when peer verification fails, at DEBUG level. I don't think it poses any practical risk as most applications do not run with debug logging enabled, and the mitigation is as easy as using a more restrictive log level, including INFO.

We can sanitize the values by replacing all newline and line break characters but the risk here is irrelevant for the vast majority of deployments.

[michaelklishin]

We don't have access to Veracode, here's a build of #623 (produced on JDK 11 but should target JDK 6+):
amqp-client-4-12.0-pr-623.jar.zip.

@lutzhorn please give the above .jar a try.

I'm not sure how much more we'd be willing to do given that we are logging the values at debug level.

I am just the messager and neither use Java 7 nor Veracode. But I have pinged the OP in SO to try this build. Let's just wait if he is happy with it. TY

[MarioLeung]

I'm the originator of this issue. As Veracode is owned by my client, I need to discuss with my client and wait for the reply on verification.

[acogoluegnes]

@MarioLeung Any update on the verification with the change?

[MarioLeung]

@acogoluegnes I haven't got any responses from my client. Will ask them this week and reply to you on next week.

[MarioLeung]

@acogoluegnes I haven't got any responses from my client yet. Let's wait one more week to see. If my client still does not have any responses, you can close the issue.

[MarioLeung]

@acogoluegnes, sorry for the late update. I FINALLY got response from clients. They understand the issues is not critical. The error will be ignored in Veracode report.