Description
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Kafka | Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kafka:kafka | >= 2.0.0, < 2.0.2 | 2.0.2 | GHSA-6jmf-mxwf-r3jc |
| Maven | org.apache.kafka:kafka | >= 2.1.0, < 2.1.2 | 2.1.2 | GHSA-6jmf-mxwf-r3jc |
| Maven | org.apache.kafka:kafka | >= 2.2.0, < 2.2.2 | 2.2.2 | GHSA-6jmf-mxwf-r3jc |
| Maven | org.apache.kafka:kafka | >= 2.3.0, < 2.3.1 | 2.3.1 | GHSA-6jmf-mxwf-r3jc |
Advisories 1
- WID-SEC-2022-2344 IBM QRadar SIEM: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 15, 2022
References
- [kafka-users] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint mailing-list
- [oss-security] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint mailing-list
- [announce] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint mailing-list
- [kafka-dev] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint mailing-list
- [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250) mailing-list
- [druid-commits] 20200126 [GitHub] [druid] clintropolis opened a new pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200126 [GitHub] [druid] suneet-s commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200126 [GitHub] [druid] clintropolis commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200126 [GitHub] [druid] clintropolis commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] ccaominh opened a new pull request #9261: Address CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] suneet-s commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] ccaominh commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on a change in pull request #9261: Address CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] ccaominh closed pull request #9261: Address CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] ccaominh commented on issue #9261: Address CVE-2019-12399 mailing-list
- [druid-commits] 20200127 [GitHub] [druid] jihoonson merged pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399 mailing-list
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization mailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- [kafka-commits] 20210921 [kafka-site] branch asf-site updated: Add CVE-2021-38153 (#375) mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html