# Announcement: Upgrade to 1.2.1 to resolve CVE-2018-1000060

**URL:** <https://discourse.sensu.io/t/announcement-upgrade-to-1-2-1-to-resolve-cve-2018-1000060/880>\
**Category:** Sensu Classic (EOL)\
**Created:** [February 14, 2018, 10:44pm UTC](https://discourse.sensu.io/t/announcement-upgrade-to-1-2-1-to-resolve-cve-2018-1000060/880 "2018-02-14T22:44:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt\_Broberg](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@Matt\_Broberg](https://discourse.sensu.io/u/Matt_Broberg)\
**Post date:** [February 14, 2018, 10:44pm UTC](https://discourse.sensu.io/t/announcement-upgrade-to-1-2-1-to-resolve-cve-2018-1000060/880/1 "2018-02-14T22:44:07Z")

</div>

Hey all,

We want to ensure Sensu users are aware of a potential security vulnerability discovered recently. It impacts all Sensu versions earlier than 1.2.1 and its full description is [here](https://nvd.nist.gov/vuln/detail/CVE-2018-1000060) [1](https://nvd.nist.gov/vuln/detail/CVE-2018-1000060). In a nutshell, if you have passwords in your configuration, there’s a chance they’re not redacted when configuration is printed in Sensu service logs (/var/log/sensu).

For what it’s worth, this behavior of the redact method has been working in this way for 5 years, so we are reasonably confident it hasn’t been a major concern to users. Also remember users would need access to /var/log/sensu in order to view these logs. That said, we want to take this seriously and get the information to you promptly.

Please update if this concerns. Direct download to 1.2.1 is [here](https://sensuapp.org/downloads) [2](https://sensuapp.org/downloads).

All the best,

Matt

VP Community, Sensu

[Join our Community Slack](http://slack.sensu.io)

---

<div class="post-metadata">

**Author:** ![jspaleta](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/jspaleta/32/141_2.png) [@jspaleta](https://discourse.sensu.io/u/jspaleta)\
**Post date:** [November 22, 2018, 2:08am UTC](https://discourse.sensu.io/t/announcement-upgrade-to-1-2-1-to-resolve-cve-2018-1000060/880/2 "2018-11-22T02:08:01Z")

</div>