Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2019-20343 Vulnerability in maven package org.codehaus.mojo:exec-maven-plugin
CVE-2022-34158 Vulnerability in maven package org.apache.jspwiki:jspwiki-war
CVE-2019-3802 Vulnerability in maven package org.springframework.data:spring-data-jpa
CVE-2013-1966 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2012-5887 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core