CVE-2019-12399
High
Description
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Kafka
PublishedJan 14, 2020
First seenJan 14, 2020
How to fix
Update
- oracle blockchain_platform21.1.2 or later
- org.apache.kafka:kafka2.0.2, 2.1.2, 2.2.2, 2.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache kafka | 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0 | — |
| oracle banking_corporate_lending_process_management | 14.1.0, 14.3.0, 14.4.0 | — |
| oracle banking_credit_facilities_process_management | 14.1.0, 14.3.0, 14.4.0 | — |
| oracle banking_liquidity_management | 14.0.0 ≤ v ≤ 14.4.0 | — |
| oracle banking_payments | 14.4.0 | — |
| oracle banking_platform | 2.7.0 | — |
| oracle banking_supply_chain_finance | 14.2.0 ≤ v ≤ 14.4.0 | — |
| oracle banking_trade_finance_process_management | 14.1.0, 14.3.0, 14.4.0 | — |
| oracle banking_virtual_account_management | 14.1.0, 14.3.0, 14.4.0 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle communications_cloud_native_core_policy | 1.9.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle flexcube_universal_banking | 14.4.0 | — |
| org.apache.kafka:kafkaMaven | 2.0.0 ≤ v < 2.0.2, 2.1.0 ≤ v < 2.1.2, 2.2.0 ≤ v < 2.2.2, 2.3.0 ≤ v < 2.3.1 | 2.0.2, 2.1.2, 2.2.2, 2.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.