medium5.5
CVE-2023-29471
Lightbend Alpakka Kafka logs credentials on debug level
Impact
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.typesafe.akka:akka-stream-kafka_3 | < 4.0.2 | 4.0.2 |
| maven | com.typesafe.akka:akka-stream-kafka_2.13 | < 4.0.2 | 4.0.2 |
| maven | com.typesafe.akka:akka-stream-kafka_2.12 | < 4.0.2 | 4.0.2 |
| maven | com.typesafe.akka:akka-stream-kafka_2.11 | < 4.0.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightbend | Alpakka Kafka | before 4.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://akka.io/security/alpakka-kafka-cve-2023-29471.html
- https://github.com/akka/alpakka-kafka/issues/1592
- https://github.com/advisories/GHSA-55vq-xpjf-r2xc
- https://nvd.nist.gov/vuln/detail/CVE-2023-29471
- https://github.com/akka/alpakka-kafka/pull/1614/commits/4011b704e93b22f6fd956aac516c7159d384644c