CVE-2023-29471
Medium
Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
SeverityMedium
CVSS5.5
Exploit probability—
ProductLightbend Alpakka Kafka
PublishedApr 27, 2023
First seenApr 27, 2023
Weakness typeCWE-312CWE-312
How to fix
Update
- lightbend alpakka_kafka4.0.2 or later
- com.typesafe.akka:akka-stream-kafka_34.0.2 or later
- com.typesafe.akka:akka-stream-kafka_2.134.0.2 or later
- com.typesafe.akka:akka-stream-kafka_2.124.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lightbend alpakka_kafka | v < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_3Maven | v < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_2.13Maven | v < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_2.12Maven | v < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_2.11Maven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.