[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALYgK0H9P-omi=V29--MQH5obuH8xGw4r0otPzsras-c+fmQaw@mail.gmail.com>
Date: Mon, 13 Jan 2020 14:08:01 -0600
From: Randall Hauch <rhauch@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext
secrets in tasks endpoint
CVE-2019-12399: Apache Kafka Connect REST API exposes plaintext secrets in
tasks endpoint
Severity: Medium
Vendor: The Apache Software Foundation
Versions Affected:
Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0
Description:
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0,
2.2.1, or 2.3.0 are configured with one or more config providers, and a
connector is created/updated on that Connect cluster to use an externalized
secret variable in a substring of a connector configuration property value
(the externalized secret variable is not the whole configuration property
value), then any client can issue a request to the same Connect cluster to
obtain the connector's task configurations and the response will contain
the plaintext secret rather than the externalized secrets variable.
Mitigation:
Apache Kafka Connect users should upgrade to one of the following versions
where this vulnerability has been fixed:
- 2.0.2 or higher
- 2.1.2 or higher
- 2.2.2 or higher
- 2.3.1 or higher
Acknowledgements:
This issue was first reported by Oleksandr Diachenko.
Regards,
Randall
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
