CVE-2020-10750: Infoleak
First published: Thu May 21 2020(Updated: )
When using Kafka as a storage back-end, Jaeger before 1.18.1 writes plaintext and kerberos credentials to the container log files. A low privileged user could read the logs within the pod to discover the Kafka credentials as the information is disclosed as log-level info - which is the default. References: <a href="https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1">https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Jaeger | <1.18.1 | |
| redhat/jaeger | <1.18.1 | 1.18.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-10750
- https://github.com/jaegertracing/jaeger/commit/360c38bec3f9718ebba7ddbf0b409b05995f3ace
- https://bugzilla.redhat.com/show_bug.cgi?id=1838401
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750
- https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1
- https://github.com/advisories/GHSA-gh32-pc56-4c96 (Advisory)
- https://github.com/jaegertracing/jaeger/blob/e46f87376bdd2a28864864eb385ff49a6aa76330/plugin/storage/kafka/factory.go#L69
- https://github.com/jaegertracing/jaeger/blob/e46f87376bdd2a28864864eb385ff49a6aa76330/plugin/storage/kafka/factory.go#L62
- https://access.redhat.com/errata/RHSA-2020:2636
- https://access.redhat.com/security/cve/cve-2020-10750
- collector/redhat-bugzilla
- alias/CVE-2020-10750
- collector/nvd-cve
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-gh32-pc56-4c96
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- package-manager/redhat
- vendor/linuxfoundation
- canonical/linuxfoundation jaeger
- package-manager/go