Lucene search

GitHub Advisory DatabaseGHSA-55VQ-XPJF-R2XC

HistoryApr 27, 2023 - 9:30 p.m.

Lightbend Alpakka Kafka logs credentials on debug level

2023-04-2721:30:26

CWE-312

CWE-532

GitHub Advisory Database

github.com

lightbend

alpakka

kafka

configuration

debug

credentials

cleartext

log files

security

vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

Affected configurations

Vulners

Node

apachekafkaRange<4.0.2

CPENameOperatorVersion
com.typesafe.akka:akka-stream-kafkalt4.0.2

CPE	Name	Operator	Version
	com.typesafe.akka:akka-stream-kafka	lt	4.0.2

References

akka.io/security/alpakka-kafka-cve-2023-29471.html

github.com/advisories/GHSA-55vq-xpjf-r2xc

github.com/akka/alpakka-kafka/issues/1592

github.com/akka/alpakka-kafka/pull/1614/commits/4011b704e93b22f6fd956aac516c7159d384644c

nvd.nist.gov/vuln/detail/CVE-2023-29471

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for GHSA-55VQ-XPJF-R2XC