CVE-2023-30450
Medium
Description
rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches.
SeverityMedium
CVSS4.3
Exploit probability—
ProductRedpanda
PublishedApr 8, 2023
First seenApr 8, 2023
Weakness typeCWE-20Improper input validation
How to fix
Update
- redpanda redpanda23.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redpanda redpanda | v < 23.1.2 | 23.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.