CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials

Medium · published February 13, 2023

CVSS v3.1
5.5
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Published
2023-02-13T00:00Z
EPSS history
Timeline
  • 13 FEB 00:00Z
    Redpanda before 22.3.12 discloses cleartext AWS credentials
    cvelistv5