Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2021-44791 Vulnerability in maven package org.apache.druid:druid
CVE-2021-3754 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2020-13943 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2018-1000111 Vulnerability in maven package org.jenkins-ci.plugins:subversion
CVE-2021-44521 Vulnerability in maven package org.apache.cassandra:cassandra-all