Currently the JVM holds the SecHub configuration data in a unsealed way. If a JVM crashes and a dump file is produced and an attacker would have access to the file it could be possible to identify credential strings from the dump
:information_source: This is a sub issue of #3250
Wanted
An attack shall not be able to retrieve sensitive information by JVMP dump files
Solution
Use sealed objects in SecHub configuration for sensitive data
Situation
Currently the JVM holds the SecHub configuration data in a unsealed way. If a JVM crashes and a dump file is produced and an attacker would have access to the file it could be possible to identify credential strings from the dump
:information_source: This is a sub issue of #3250
Wanted
An attack shall not be able to retrieve sensitive information by JVMP dump files
Solution