When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured
    with one or more config providers, and a connector is created/updated on that Connect cluster to use an
    externalized secret variable in a substring of a connector configuration property value, then any client
    can issue a request to the same Connect cluster to obtain the connector's task configuration and the
    response will contain the plaintext secret rather than the externalized secrets variables.
    (CVE-2019-12399)

ID	Name	Product	Family	Severity
422465	SCA: security update for org.apache.kafka:kafka (GHSA-6jmf-mxwf-r3jc)	Tenable Cloud Security	SCA Checks	high
422465	SCA: security update for org.apache.kafka:kafka (GHSA-6jmf-mxwf-r3jc)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2019-12399

high

Tenable Plugins

high

high