NetSight
IP …
high7.5

CVE-2019-12399

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is cr…

Impact

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Affected products

VendorProductAffected versions
ApacheKafka
Versions 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1
OracleBanking Corporate Lending Process Management
Versions 14.1.0, 14.3.0, 14.4.0
OracleBanking Credit Facilities Process Management
Versions 14.1.0, 14.3.0, 14.4.0
OracleBanking Liquidity Management
from 14.0.0 through 14.4.0
OracleBanking Payments
Version 14.4.0
OracleBanking Platform
Version 2.7.0
OracleBanking Supply Chain Finance
from 14.2.0 through 14.4.0
OracleBanking Trade Finance Process Management
Versions 14.1.0, 14.3.0, 14.4.0
OracleBanking Virtual Account Management
Versions 14.1.0, 14.3.0, 14.4.0
OracleBlockchain Platform
before 21.1.2
OracleCommunications Cloud Native Core Policy
Version 1.9.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6 through 8.1.0

Weakness classification

CWE-319

References