Miss to call clearPassword for PBEKeySpec

[akwick]

I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses. One of the misuses for which we could confirm the finding of the analysis, CogniCryptSAST is within this project.

In the class PasswordFactory$PBKDF2Password miss to call the method clearPassword after generating the password. This method (JCA) clears an internal copy of the password from memory. Thus, it should be called to ensure that an attacker can not obtain the password from memory.

We hope that this report helps you and would be glad to get your thoughts on this issue.