Plaintext Password Present in the Web logs

An attacker who can observe or access OpenNMS application log files can obtain usernames and passwords when the logging level is set to DEBUG. The advisory notes that OpenNMS is intended for installation within private networks and should not be directly accessible from the Internet, so the attack vector is local or network-adjacent access to log storage. No authentication or special privileges are required to read the logs if they are stored with weak permissions. The sensitive information is leaked passively through normal application operation when debug logging is enabled.

The patch modifies `opennms-base-assembly/src/main/filtered/etc/log4j2.xml` by adding a new logger entry for `org.eclipse.jetty.server.HttpInput` at INFO level. Previously, Jetty's `HttpInput` logger was not explicitly configured, so it inherited the root logger's DEBUG level, which caused sensitive request data (including credentials) to be written into application logs.

The patch adds an explicit logger for `org.eclipse.jetty.server.HttpInput` at INFO level with `additivity="false"`, which prevents the logger from inheriting the root logger's DEBUG level. By capping the Jetty HTTP input logger at INFO, sensitive request data such as usernames and passwords that Jetty logs at DEBUG level are no longer written to the application logs. The `additivity="false"` attribute ensures the message is only sent to the RoutingAppender and not propagated to the root logger.