CVE-2023-24619

    Dashboard / Vulnerabilities / CVE-2023-24619

    CVE-2023-24619

    Published: 13 Feb 2023Last Modified: 28 Oct 2026

    Summary:

    Details: Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24619.json, https://nvd.nist.gov/vuln/detail/CVE-2023-24619, https://github.com/redpanda-data/redpanda/pull/8339

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4dc385349da3a953de21d7227735ed1990e2f206

    Affected versions

    v22.2.8
    v22.2.10-rc2
    v22.2.10-rc1
    v22.2.9-rc3
    v22.2.9
    v22.2.9-rc2
    v22.2.9-rc1
    v22.2.8-rc5
    v22.2.8-rc4
    v22.2.8-rc3
    v22.2.8-rc2
    v22.2.8-rc1
    v22.2.7-rc2
    v22.2.7
    v22.2.7-rc1
    v22.2.6-rc1
    v22.2.6
    v22.2.5-rc1
    v22.2.5
    v22.2.4
    v22.2.4-rc1
    v22.2.3-rc1
    v22.2.3
    v22.2.2-rc3
    v22.2.2
    v22.2.2-rc2
    v22.2.2-rc1
    v22.2.1
    v22.2.1-rc5
    v22.2.1-rc4
    v22.2.1-rc3
    v22.2.1-rc2
    v22.2.1-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High