CVE-2023-51390
21.12.2023, 00:15
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.Enginsight
| Vendor | Product | Version |
|---|---|---|
| aiven | journalpump | 𝑥 < 2.5.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-215 - Insertion of Sensitive Information Into Debugging CodeThe application inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
- CWE-319 - Cleartext Transmission of Sensitive InformationThe software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
References