Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2019-10369 Vulnerability in maven package org.jenkins-ci.plugins:jclouds-jenkins
CVE-2020-10203 Vulnerability in maven package org.sonatype.nexus:nexus-core
CVE-2023-38700 Vulnerability in npm package matrix-appservice-irc
CVE-2010-1244 Vulnerability in maven package org.apache.activemq:activemq-web
CVE-2023-30521 Vulnerability in maven package org.jenkins-ci.plugins:assembla-merge-request-builder