PT-2020-12312 · Jaegertracing · Jaeger

Chlunde · Published 2020-06-19 · Updated 2024-08-21 · CVE-2020-10750

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jaegertracing/jaeger versions prior to 1.18.1

Description A sensitive information exposure issue was discovered when the Kafka data store is used, allowing an attacker with access to the container's log file to obtain the Kafka credentials.

Recommendations For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the container's log file to minimize the risk of exploitation.

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

BIT-JAEGER-2020-10750

CVE-2020-10750

GHSA-GH32-PC56-4C96

GO-2022-0834

Affected Products

Jaeger

References · 10

• https://osv.dev/vulnerability/CVE-2020-10750 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jaeger-2020-10750 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10750 · Security Note
• https://osv.dev/vulnerability/GHSA-gh32-pc56-4c96 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0834 · Vendor Advisory
• https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1 · Note
• https://github.com/jaegertracing/jaeger/commit/360c38bec3f9718ebba7ddbf0b409b05995f3ace · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1838401 · Note
• https://github.com/advisories/GHSA-gh32-pc56-4c96 · Note