Enhance security and logging by masking sensitive information in JDBC connection strings
Details
| Detail name | Value |
|---|---|
| Changelog Number | 24634 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 7.1.0 |
| Fix Versions | JDBC 25.2.4 |
| Resolution Date | 2025-06-20 |
Description
When a JDBC connection string includes a password parameter (e.g. jdbc:exa:host:port;user=admin;password=securepassword) and debug mode is activated, the password value may be exposed in plaintext in application logs. This behavior occurs only when the password is explicitly included in the connection string.
Workaround
To prevent password exposure in logs, avoid explicitly including the password in the connection string when possible.
Fix
The issue has been fixed by updating the application to mask passwords in JDBC connection strings when they appear in debug logs.
Now, if the password parameter is included in the connection string, it will no longer be shown in plaintext in the logs. Instead, it will be replaced with (******) for security purposes.
This change automatically applies when debug mode is enabled. If no password is present in the connection string, the logged output will remain as is.
