Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2023-24998 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2017-5641 Vulnerability in maven package com.adobe.blazeds:flex-messaging-core
CVE-2023-37913 Vulnerability in maven package org.xwiki.platform:xwiki-platform-office-importer
CVE-2014-3579 Vulnerability in maven package org.apache.activemq:apollo-selector
CVE-2023-24437 Vulnerability in maven package org.jenkins-ci.plugins:jira-steps