akka/alpakka-kafka · Security
Lightbend Alpakka Kafka logs credentials on debug level
- GHSA ID
- GHSA-55vq-xpjf-r2xc
- CVE ID
- CVE-2023-29471
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
CWEs
- CWE-312 · Cleartext Storage of Sensitive Information
- CWE-532 · Insertion of Sensitive Information into Log File
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-29471 ↗
- https://github.com/akka/alpakka-kafka/issues/1592 ↗
- https://akka.io/security/alpakka-kafka-cve-2023-29471.html ↗
- https://github.com/akka/alpakka-kafka/pull/1614/commits/4011b704e93b22f6fd956aac516c7159d384644c ↗
- https://github.com/advisories/GHSA-55vq-xpjf-r2xc ↗