Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2020-11998 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2023-35926 Vulnerability in npm package @backstage/plugin-scaffolder-backend
CVE-2020-2194 Vulnerability in maven package io.jenkins.plugins:echarts-api
CVE-2014-0149 Vulnerability in maven package org.jboss.seam:jboss-seam-remoting
CVE-2023-6393 Vulnerability in maven package io.quarkus:quarkus-cache