Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2023-26479 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-parser
CVE-2021-21613 Vulnerability in maven package io.jenkins.plugins:tics
CVE-2013-4322 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2023-45137 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2020-17532 Vulnerability in maven package org.apache.servicecomb:foundation-config