Code injection

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-24619: Insufficiently Protected Credentials

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

PT-2023-19711

Name of the Vulnerable Software and Affected Versions Redpanda versions prior to 22.3.12 Redpanda versions prior to 22.2.10 Redpanda versions prior to 22.1.12 Description The issue allows a local user to view AWS Access Key ID and Secret in cleartext, as the import functionality in the rpk binary...

PT-2022-28192

Name of the Vulnerable Software and Affected Versions ctx affected versions not specified Description The ctx project on PyPI was compromised, and a malicious version was uploaded, which collects environment variables, including sensitive data like passwords and API keys, such as AWS ACCESS KEY I...