Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
High severity
GitHub Reviewed
Published
May 12, 2020
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.0.0, <= 2.0.1
>= 2.1.0, <= 2.1.1
>= 2.2.0, <= 2.2.1
= 2.3.0
Patched versions
2.0.2
2.1.2
2.2.2
2.3.1
Description
Published by the National Vulnerability Database
Jan 14, 2020
Reviewed
May 11, 2020
Published to the GitHub Advisory Database
May 12, 2020
Last updated
Feb 1, 2023
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
References