PT-2023-22697 · Redpanda · Redpanda

Publicado 2023-04-08 · Atualizado 2023-04-17 · CVE-2023-30450

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redpanda versions prior to 23.1.2 Redpanda versions 22.2 and 22.3 (before the backported fix)

Description The issue arises from the mishandling of the redpanda.rpc server tls field by rpk in Redpanda, leading to situations where there is a data type mismatch. This mismatch cannot be automatically fixed by rpk, and instead, a user must reconfigure (while a cluster is turned off) to have TLS on broker RPC ports.

Recommendations For Redpanda versions prior to 23.1.2, update to version 23.1.2 or later to resolve the issue. For Redpanda versions 22.2 and 22.3, apply the backported fix to resolve the issue. As a temporary workaround, consider reconfiguring the redpanda.rpc server tls field while the cluster is turned off to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-30450

Produtos afetados

Redpanda

Referências · 9

• https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2 · Nota
• https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7 · Correção
• https://github.com/redpanda-data/redpanda/pull/7719 · Correção
• https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365 · Correção
• https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557 · Correção
• https://osv.dev/vulnerability/CVE-2023-30450 · Aviso do Fabricante
• https://t.me/cvenotify/47829 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30450 · Nota de Segurança
• https://t.me/cibsecurity/61713 · Publicação no Telegram