CVE-2023-51390: Information Disclosure Vulnerability in Journalpump
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-51390?
CVE-2023-51390 is considered to be a moderate severity vulnerability due to the potential exposure of sensitive credential information.
How do I fix CVE-2023-51390?
To fix CVE-2023-51390, upgrade journalpump to version 2.5.0 or later to ensure that credential information is not logged in plaintext.
What types of systems are affected by CVE-2023-51390?
CVE-2023-51390 affects versions of Aiven Journalpump prior to 2.5.0.
Is credential data at risk due to CVE-2023-51390?
Yes, CVE-2023-51390 logs configuration details, which may include credential information, in plaintext.
Can CVE-2023-51390 lead to data breaches?
Yes, if exploited, CVE-2023-51390 could lead to data breaches due to the exposure of sensitive credentials.