Description

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

Remediation

References

https://github.com/akka/alpakka-kafka/issues/1592

https://akka.io/security/alpakka-kafka-cve-2023-29471.html

Related Vulnerabilities

CVE-2020-7650 Vulnerability in npm package snyk-broker

CVE-2022-4492 Vulnerability in maven package io.undertow:undertow-core

CVE-2019-1003080 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer

CVE-2023-31058 Vulnerability in maven package org.apache.inlong:manager-common

CVE-2023-26471 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Vendor Advisory