| Package | Affected versions | Patched versions |
|---|---|---|
| com.typesafe.akka:akka-stream-kafka_2.11 | all versions | |
| com.typesafe.akka:akka-stream-kafka_2.12 | < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_2.13 | < 4.0.2 | 4.0.2 |
| com.typesafe.akka:akka-stream-kafka_3 | < 4.0.2 | 4.0.2 |
| alpakka kafka | < 4.0.2 | 4.0.2 |
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free