CVE-2023-29471
First published: Thu Apr 27 2023(Updated: )
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lightbend Alpakka Kafka | <4.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://akka.io/security/alpakka-kafka-cve-2023-29471.html
- https://github.com/akka/alpakka-kafka/issues/1592
- https://nvd.nist.gov/vuln/detail/CVE-2023-29471
- https://github.com/akka/alpakka-kafka/pull/1614/commits/4011b704e93b22f6fd956aac516c7159d384644c
- https://github.com/advisories/GHSA-55vq-xpjf-r2xc (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-29471.
How does Lightbend Alpakka Kafka before 4.0.2 expose credentials?
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured.
Which component of Lightbend Alpakka Kafka is affected by this vulnerability?
This vulnerability affects the akka.kafka.internal.KafkaConsumerActor component of Lightbend Alpakka Kafka.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is medium, with a score of 5.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
How can I fix this vulnerability?
To fix this vulnerability, update to Lightbend Alpakka Kafka version 4.0.2 or higher.
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-55vq-xpjf-r2xc
- alias/CVE-2023-29471
- collector/github-advisory
- agent/author
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- agent/trending
- vendor/lightbend
- canonical/lightbend alpakka kafka
- package-manager/maven