PT-2023-24824 · Jetbrains · Jetbrains Ktor

Published 2023-06-01 · Updated 2023-06-08 · CVE-2023-34339

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains Ktor versions prior to 2.3.1

Description The issue allows headers containing authentication data to be added to the exception's message. This could potentially expose sensitive information.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive authentication data until the update is applied.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-34339

Affected Products

Jetbrains Ktor

References · 6

• https://osv.dev/vulnerability/CVE-2023-34339 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34339 · Security Note
• https://t.me/cvenotify/51594 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34339 · Note
• https://t.me/cibsecurity/64868 · Telegram Post