[GHSA-5gj6-62g7-vmgf] Hazelcast vulnerable to unmasked password exposure

[joshbressers]

Updates

• Affected products

Comments
After this was filed, fixes for other branches were merged (look about halfway down in the issue)
hazelcast/hazelcast#24266

[Copilot]

Pull Request Overview

This PR updates a GitHub security advisory (GHSA-5gj6-62g7-vmgf) for Hazelcast's unmasked password exposure vulnerability to include additional affected product versions and their corresponding fixes.

• Updates the modification timestamp to reflect recent changes
• Adds version ranges for Hazelcast 5.0.x, 5.1.x, and 5.2.x branches with their respective fix versions
• Completes the existing 5.3.0-BETA-1 range that was already present

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[helixplant]

Hi @joshbressers. Before I update the advisory, I want to confirm the following with you to ensure the vulnerable version ranges are correct. I noticed hazelcast/hazelcast#24266 (comment) mentions version 3 not being affected and version 4 being partially affected. Additionally, looking at your proposed changes to this advisory is the following vulnerable version range proposal correct?

Vulnerable from 4.2.0-BETA-1 to 4.2.8, no fix version
Vulnerable from 5.0.0 to 5.0.4, fixed in 5.0.5
Vulnerable from 5.1.0 to 5.1.5, fixed in 5.1.6
Vulnerable from 5.2.0 to 5.2.3, fixed in 5.2.4
Vulnerable in 5.3.0-BETA-1, fixed in 5.3.0

[helixplant]

Hi @joshbressers. Just checking back in to see if the version range posted above looks correct.

[joshbressers]

Hi @helixplant

Apologies for missing this

I took a look at versions on Maven Central
https://mvnrepository.com/artifact/com.hazelcast/hazelcast?

Should we start the 5.0 series at 5.0-BETA-1?

Good catch on the 4.x versions. This range is probably acceptable, but we could go all the way back to 4.0-BETA-1

Thanks!

[advisory-database]

Hi @joshbressers! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[helixplant]

The advisory should be updated now, please let me know if anything looks off.