PT-2023-19711 · Redpanda · Redpanda

Publicado 2023-02-13 · Atualizado 2025-03-21 · CVE-2023-24619

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redpanda versions prior to 22.3.12 Redpanda versions prior to 22.2.10 Redpanda versions prior to 22.1.12

Description The issue allows a local user to view AWS Access Key ID and Secret in cleartext, as the import functionality in the rpk binary logs these credentials to standard output. This can be viewed in the console or in Kubernetes logs if stdout output is collected.

Recommendations For versions prior to 22.3.12, update to version 22.3.12 or later. For versions prior to 22.2.10, update to version 22.2.10 or later. For versions prior to 22.1.12, update to version 22.1.12 or later.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-24619

Produtos afetados

Redpanda

Referências · 5

• 🔥 https://github.com/redpanda-data/redpanda/pull/8339 · Exploit
• https://t.me/cibsecurity/58020 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-24619 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24619 · Nota de Segurança
• https://t.me/cvenotify/115707 · Publicação no Telegram