GitHub Advisoryadvisory · Maven

GHSA-55vq-xpjf-r2xc Lightbend Alpakka Kafka logs credentials on debug level

MEDIUM Published 2023-04-27 Modified 2025-09-30 Official page ↗
Aliases
CVE-2023-29471
Ecosystem
Maven
Packages
com.typesafe.akka:akka-stream-kafka_3, com.typesafe.akka:akka-stream-kafka_2.13, com.typesafe.akka:akka-stream-kafka_2.12, com.typesafe.akka:akka-stream-kafka_2.11
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312, CWE-532
Reviewed
2023-04-27

Affected packages

• Maven com.typesafe.akka:akka-stream-kafka_3: < 4.0.2 → fixed in 4.0.2 • Maven com.typesafe.akka:akka-stream-kafka_2.13: < 4.0.2 → fixed in 4.0.2 • Maven com.typesafe.akka:akka-stream-kafka_2.12: < 4.0.2 → fixed in 4.0.2 • Maven com.typesafe.akka:akka-stream-kafka_2.11: < 4.0.2 (no fix yet)

Description

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

Related

Alias · CVE (1)

  • CVE-2023-29471 Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References