CVEvulnerability
CVE-2023-29471
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-04-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-312
Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Affected configurations
• lightbend alpakka kafka (< 4.0.2)
Related
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- https://akka.io/security/alpakka-kafka-cve-2023-29471.html Vendor Advisory
- https://github.com/akka/alpakka-kafka/issues/1592 Issue Tracking
- https://akka.io/security/alpakka-kafka-cve-2023-29471.html Vendor Advisory
- https://github.com/akka/alpakka-kafka/issues/1592 Issue Tracking