Vulnerability in Apache Kafka
CVE-2019-12399
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.039 (90.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.039 · newest: 0.039 · change: 0.000
Affected products
- Apache Kafka — versions 2.2.0, 2.0.1, 2.1.0
- Oracle Banking Corporate Lending Process Management — versions 14.1.0, 14.3.0, 14.4.0
- Oracle Banking Credit Facilities Process Management — versions 14.1.0, 14.3.0, 14.4.0
- Oracle Banking Liquidity Management
- Oracle Banking Payments — versions 14.4.0
- Oracle Banking Platform — versions 2.7.0
- Oracle Banking Supply Chain Finance
- Oracle Banking Trade Finance Process Management — versions 14.1.0, 14.3.0, 14.4.0
- Oracle Banking Virtual Account Management — versions 14.1.0, 14.3.0, 14.4.0
- Oracle Blockchain Platform
Weakness classification (CWE)
References
- lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914… (mailing-list)
- www.openwall.com/lists/oss-security/2020/01/14/1 (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914… (mailing-list)
- lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914… (Vendor Advisory, mailing-list, Mailing List)
- lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f342dfa8… (mailing-list)
- lists.apache.org/thread.html/rde947ee866de6687bc51cdc8dfa6d7e6b3ad4ce8c708c344f… (mailing-list)
- lists.apache.org/thread.html/r4b20b40c40d4a4c641e2ef4228098a57935e5782bfdfdf365… (mailing-list)
- lists.apache.org/thread.html/r6fa1cff4786dcef2ddd1d717836ef123c878e8321c24855ba… (mailing-list)
- lists.apache.org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76… (mailing-list)
- lists.apache.org/thread.html/rfe90ca0463c199b99c2921410639aed53a172ea8b733eab0d… (mailing-list)
Frequently asked questions
- What is CVE-2019-12399?
- CVE-2019-12399 is a high-severity vulnerability in Apache Kafka, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2020-01-14.
- How severe is CVE-2019-12399?
- High severity. CVSS v3 base score is 7.5 out of 10.