---
title: Security Bulletin NR18-09
source: https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-09
---

## Summary

A security update for the Java agent corrects an issue where the agent may not properly obfuscate all SQL query information when `record_sql` is set to `off`.

**Release date:** May 2, 2018

**Vulnerability identifier:** NR18-09

**Priority:** Low

## Affected software [#affected]

The following New Relic agent versions are affected:

| **Name**   | **Affected versions** | Remediated Version                                                                           |
| ---------- | --------------------- | -------------------------------------------------------------------------------------------- |
| Java agent | All                   | [4.1.0](https://docs.newrelic.com/docs/release-notes/agent-release-notes/java-release-notes) |

## Vulnerability information [#vuln-info]

The New Relic Java agent runs explain plans for [slow transaction traces](https://docs.newrelic.com/docs/apm/applications-menu/monitoring/viewing-slow-query-details) and slow SQL queries. When a customer has set `record_sql` to `off`, is running PostgreSQL, and has an explain plan run, the agent may not properly obfuscate all information in the query.

## Workarounds

Disable `explain` plans with `transaction_tracer` in the [Java agent configuration](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#h2-Transaction-tracer).

## Report security vulnerabilities to New Relic [#report]

New Relic is committed to the security of our customers and their data. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic's coordinated disclosure program. For more information, see [Reporting security vulnerabilities](https://docs.newrelic.com/docs/security/new-relic-security/data-privacy/reporting-security-vulnerabilities).

## For more help [#more_help]

Additional documentation resources include:.

-   [Upgrade the Java agent](https://docs.newrelic.com/docs/agents/java-agent/installation/upgrade-java-agent)
-   [NR Security](https://newrelic.com/security)