GitHub Advisoryadvisory · Go

GHSA-gh32-pc56-4c96 Information Exposure in jaeger

MEDIUM Published 2021-05-18 Modified 2023-09-15 Official page ↗
Aliases
CVE-2020-10750
Ecosystem
Go
Packages
github.com/jaegertracing/jaeger
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2021-05-12

Affected packages

• Go github.com/jaegertracing/jaeger: < 1.18.1 → fixed in 1.18.1

Description

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.

Related

Alias · CVE (1)

  • CVE-2020-10750 Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References