PT-2023-22697 · Redpanda · Redpanda

Published 2023-04-08 · Updated 2023-04-17 · CVE-2023-30450

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redpanda versions prior to 23.1.2 Redpanda versions 22.2 and 22.3 (before the backported fix)

Description The issue arises from the mishandling of the redpanda.rpc server tls field by rpk in Redpanda, leading to situations where there is a data type mismatch. This mismatch cannot be automatically fixed by rpk, and instead, a user must reconfigure (while a cluster is turned off) to have TLS on broker RPC ports.

Recommendations For Redpanda versions prior to 23.1.2, update to version 23.1.2 or later to resolve the issue. For Redpanda versions 22.2 and 22.3, apply the backported fix to resolve the issue. As a temporary workaround, consider reconfiguring the redpanda.rpc server tls field while the cluster is turned off to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-30450

Affected Products

Redpanda

References · 9

• https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7 · Patch
• https://github.com/redpanda-data/redpanda/pull/7719 · Patch
• https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365 · Patch
• https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557 · Patch
• https://osv.dev/vulnerability/CVE-2023-30450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30450 · Security Note
• https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2 · Note
• https://t.me/cvenotify/47829 · Telegram Post
• https://t.me/cibsecurity/61713 · Telegram Post