CVE-2023-24619
Last modified
CVE-2023-24619 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redpanda | Redpanda | >= 22.1.0, < 22.1.12 |
| Redpanda | Redpanda | >= 22.2.0, < 22.2.10 |
| Redpanda | Redpanda | >= 22.3.0, < 22.3.12 |
References
- https://github.com/redpanda-data/redpanda/pull/8339Exploit, Patch, Vendor Advisory
- https://github.com/redpanda-data/redpanda/pull/8339Exploit, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-24619?
How severe is CVE-2023-24619?
How do I fix CVE-2023-24619?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-24607Qt before 6.4.3 allows a denial of service via a crafted str…7.5
- CVE-2023-24609Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a l…7.5
- CVE-2023-2461Use after free in OS Inputs in Google Chrome on ChromeOS pri…8.8
- CVE-2023-24610NOSH 4a5cfdb allows remote authenticated users to execute PH…8.8
- CVE-2023-24612The PdfBook extension through 2.0.5 before b07b6a64 for Medi…9.8
- CVE-2023-24613The user interface of Array Networks AG Series and vxAG thro…4.9
- CVE-2023-2462Inappropriate implementation in Prompts in Google Chrome pri…4.3
- CVE-2023-24620An issue was discovered in Esoteric YamlBeans through 1.15. …5.5
- CVE-2023-24621An issue was discovered in Esoteric YamlBeans through 1.15. …7.8
- CVE-2023-24622isInList in the safeurl-python package before 1.2 for Python…5.3
- CVE-2023-24623Paranoidhttp before 0.3.0 allows SSRF because [::] is equiva…7.5
- CVE-2023-24625Faveo 5.0.1 allows remote attackers to obtain sensitive info…6.5
Are you affected by CVE-2023-24619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST