GHSA-55vq-xpjf-r2xc

Lightbend Alpakka Kafka logs credentials on debug level

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-29471

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.typesafe.akka:akka-stream-kafka_3	< 4.0.2	4.0.2
Maven	com.typesafe.akka:akka-stream-kafka_2.13	< 4.0.2	4.0.2
Maven	com.typesafe.akka:akka-stream-kafka_2.12	< 4.0.2	4.0.2
Maven	com.typesafe.akka:akka-stream-kafka_2.11	< 4.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-29471 advisory
https://github.com/akka/alpakka-kafka/issues/1592 web
https://github.com/akka/alpakka-kafka/pull/1614/commits/4011b704e93b22f6fd956aac516c7159d384644c web
https://akka.io/security/alpakka-kafka-cve-2023-29471.html web
https://github.com/akka/alpakka-kafka package