CVE-2023-24619: Medium severity redpanda vulnerability
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What are the risks associated with CVE-2023-24619?
CVE-2023-24619 allows local users to view sensitive AWS credentials in cleartext, posing a risk of unauthorized access to AWS resources.
What is the severity of CVE-2023-24619?
CVE-2023-24619 is considered a medium severity vulnerability due to the potential exposure of sensitive AWS credentials.
How do I fix CVE-2023-24619?
To fix CVE-2023-24619, upgrade Redpanda to version 22.3.12 or later.
Which versions of Redpanda are affected by CVE-2023-24619?
CVE-2023-24619 affects Redpanda versions prior to 22.3.12.
Is CVE-2023-24619 a local or remote vulnerability?
CVE-2023-24619 is a local vulnerability, impacting users with access to the system where Redpanda is running.