Information Disclosure Vulnerability in Journalpump
CVE-2023-51390

6.5MEDIUM

Key Information:

Vendor

Aiven-Open

Status
journalpump
Vendor
CVE Published:
21 December 2023

What is CVE-2023-51390?

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

Affected Version(s)

journalpump < 2.5.0

References

https://github.com/Aiven-Open/journalpump/security/adviso...
x_refsource_CONFIRM
https://github.com/Aiven-Open/journalpump/commit/390e69bc...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.