When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: apache
Published: 2020-01-14T14:28:57
Updated: 2024-08-04T23:17:40.107Z
Reserved: 2019-05-28T00:00:00
Link: CVE-2019-12399
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-01-14T15:15:12.803
Modified: 2024-11-21T04:22:45.463
Link: CVE-2019-12399
Redhat