CVE-2020-10750: Infoleak
Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
Other sources
When using Kafka as a storage back-end, Jaeger before 1.18.1 writes plaintext and kerberos credentials to the container log files. A low privileged user could read the logs within the pod to discover the Kafka credentials as the information is disclosed as log-level info - which is the default.
References:
https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10750?
CVE-2020-10750 has been assessed as a low severity vulnerability.
How do I fix CVE-2020-10750?
To fix CVE-2020-10750, upgrade to Jaeger version 1.18.1 or later.
What are the implications of CVE-2020-10750?
CVE-2020-10750 can allow low privileged users to access sensitive Kafka credentials logged in plaintext.
Which versions of Jaeger are affected by CVE-2020-10750?
Jaeger versions prior to 1.18.1 are affected by CVE-2020-10750.
What components does CVE-2020-10750 affect?
CVE-2020-10750 affects Jaeger when using Kafka as a storage backend.