Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2020-2291 Vulnerability in maven package org.jenkins-ci.plugins:couchdb-statistics
CVE-2018-14041 Vulnerability in npm package bootstrap
CVE-2018-1000011 Vulnerability in maven package org.jvnet.hudson.plugins.findbugs:parent
CVE-2023-48292 Vulnerability in maven package org.xwiki.contrib:xwiki-application-admintools
CVE-2018-1000130 Vulnerability in maven package org.jolokia:jolokia-core