漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenBao leaks HTTPRawBody in Audit Logs
Vulnerability Description
OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.
CVSS Information
N/A
Vulnerability Type
通过日志文件的信息暴露
Vulnerability Title
OpenBao 日志信息泄露漏洞
Vulnerability Description
OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.2.0版本至2.4.1版本存在日志信息泄露漏洞，该漏洞源于审计日志未正确编辑原始HTTP主体，可能导致ACME验证码和OIDC响应代码泄露。
CVSS Information
N/A
Vulnerability Type
N/A