Heap Security Vulnerability

Question

I launched the java application against the checkmarkx tool for a security vulnerability, and it constantly gives a problem - Heap Inspection, for my password field, for which I use an array of characters. This provides no more explanation than just specifying a password field declaration.

private char[] passwordLength;

Can someone help me here, what else can I find for this?

Answer 1

Heap checking is confidential information stored in the computer’s memory, unencrypted, so if an attacker performs a memory dump (for example, a Heartbleed error), this information is compromised. Thus, simply storing this information makes it vulnerable.

, ​​ , , GuardedString String char, , .

. CWE ( C/++, ​​ Java).

Answer 2

security.stackexchange.com " char [] ".

TL;DR: .

PS: , (, ). , / .