CVE-2023-30450: Input Validation
rpk in Redpanda before 23.1.2 mishandles the redpanda.rpcservertls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30450?
CVE-2023-30450 has been categorized with a high severity due to the significant impact it can have on TLS configurations in Redpanda.
How do I fix CVE-2023-30450?
To fix CVE-2023-30450, you must manually reconfigure the redpanda.rpc_server_tls field while the cluster is turned off to ensure proper TLS on broker RPC.
What versions of Redpanda are affected by CVE-2023-30450?
CVE-2023-30450 affects all Redpanda versions prior to 23.1.2.
What are the consequences of not addressing CVE-2023-30450?
Failure to address CVE-2023-30450 may lead to data type mismatches and potential security vulnerabilities due to improper TLS configurations.
Who is impacted by CVE-2023-30450?
Any users or organizations utilizing Redpanda versions before 23.1.2 that require TLS for broker RPC operations are impacted by CVE-2023-30450.