PT-2023-22270 · Lightbend · Alpakka Kafka

Name of the Vulnerable Software and Affected Versions: Lightbend Alpakka Kafka versions prior to 5.0.0 Description: The issue allows log files to contain credentials if plain cleartext login is configured, as the configuration is logged as debug information. This occurs in the...

CVE-2023-29471

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

Lightbend Alpakka Kafka 安全漏洞

Lightbend Alpakka Kafka is a powerful connector from Lightbend USA. A security vulnerability exists in Lightbend Alpakka Kafka versions prior to 5.0.0 that stems from log files containing sensitive information...

CVE-2023-29471

Lightbend Alpakka Kafka before 5.0.0 stores configuration in debug logs, potentially exposing credentials in log files via akka.kafka.internal.KafkaConsumerActor. AFFECTED: Lightbend Alpakka Kafka versions prior to 5.0.0. IMPACT: credential exposure in log files. REMEDIATION: upgrade to 5.0.0 or ...

CVE-2023-29471

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

com.lightbend.akka:kube-actions_2.12 (>=0.0.0-1-5c26b172 <=0.1.1), com.lightbend.akka:kube-actions_2.13 (>=0.0.0-1-5c26b172 <=0.1.1) +170 more potentially affected by CVE-2021-4178 via io.fabric8:kubernetes-client (>=5.0.0-beta-1 <=5.0.2)

io.fabric8:kubernetes-client MAVEN version =5.0.0-beta-1, =0.0.0-1-5c26b172, =0.0.0-1-5c26b172, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504,...

Lightbend Play Framework 安全漏洞

Lightbend Play Framework is a web application framework written in the Scala language from Lightbend, Inc. A security vulnerability exists in Lightbend Play Framework prior to version 2.8.16, which originates from the easy generation of error messages containing sensitive information...

com.lightbend.akka:kube-actions_2.12 (>=0.0.0-1-5c26b172 <=0.1.1), com.lightbend.akka:kube-actions_2.13 (>=0.0.0-1-5c26b172 <=0.1.1) +141 more potentially affected by CVE-2021-20218 via io.fabric8:kubernetes-client (>=5.0.0 <=5.0.1)

io.fabric8:kubernetes-client MAVEN version =5.0.0, =0.0.0-1-5c26b172, =0.0.0-1-5c26b172, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504, =0.0.1-back-to-core-20210504...

Lightbend Play Framework Input Validation Error Vulnerability

Lightbend Play Framework is the United States Lightbend company a use of Scala language written in the Web application framework. A security vulnerability exists in Play Framework versions 2.6.0 through 2.8.2, which originates when an application accepts multi-part form-data JSON inputs and the...

CVE-2019-17598

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

Design/Logic Flaw

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

CVE-2019-17598

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

CVE-2019-17598

CVE-2019-17598 affects Lightbend Play Framework (2.5.x–2.6.23) and its play-ws component. When configured to proxy requests through an authenticated HTTP proxy, under high load, HTTPS connections to a target host may reveal proxy credentials to that host. Impact is information disclosure; details...

Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of a field composed of many decimal digits...

Uncontrolled Resource Consumption in spray-json

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of many JSON object fields with keys that have the same hash code...

Lightbend Spray spray-json denial of service vulnerability (CNVD-2019-43396)

Lightbend Spray spray-json is a lightweight JSON implementation used in Scala. A security vulnerability exists in Lightbend Spray spray-json version 1.3.4 and earlier. An attacker can exploit this vulnerability to cause a denial of service resource consumption...

Lightbend Spray spray-json Denial of Service Vulnerability

Lightbend Spray spray-json is a lightweight JSON implementation used in Scala. A security vulnerability exists in Lightbend Spray spray-json 1.3.4 and earlier. A remote attacker can cause a denial of service resource consumption with a field consisting of multiple decimal numbers...

Code injection

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of many JSON object fields with keys that have the same hash code...

CVE-2018-18853

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of a field composed of many decimal digits...

CVE-2018-18854

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of many JSON object fields with keys that have the same hash code...