CVE-2023-51390 - Vulnerability Details - OpenCVE

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00077.

Key SSVC decision points have not yet been added.

Vendors	Products
Aiven	Journalpump

Configuration 1 [-]

cpe:2.3:a:aiven:journalpump:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da
https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-20T23:27:10.958Z

Updated: 2024-08-02T22:32:09.162Z

Reserved: 2023-12-18T19:35:29.004Z

Link: CVE-2023-51390

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-21T00:15:26.163

Modified: 2024-11-21T08:38:00.733

Link: CVE-2023-51390

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-51390", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-18T19:35:29.004Z", "datePublished": "2023-12-20T23:27:10.958Z", "dateUpdated": "2024-08-02T22:32:09.162Z"}, "containers": {"cna": {"title": "Information Disclosure Vulnerability in Journalpump", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-215", "lang": "en", "description": "CWE-215: Insertion of Sensitive Information Into Debugging Code", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g"}, {"name": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da", "tags": ["x_refsource_MISC"], "url": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da"}], "affected": [{"vendor": "Aiven-Open", "product": "journalpump", "versions": [{"version": "< 2.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-20T23:27:10.958Z"}, "descriptions": [{"lang": "en", "value": "journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0."}], "source": {"advisory": "GHSA-738v-v386-8r6g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:32:09.162Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g"}, {"name": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aiven:journalpump:*:*:*:*:*:*:*:*", "matchCriteriaId": "DACAD721-755F-4ED0-B6B7-1A37E9BADB86", "versionEndExcluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0."}, {"lang": "es", "value": "journalpump es un daemon que toma mensajes de registro de journald y los env\u00eda a una salida determinada. Se encontr\u00f3 una vulnerabilidad de registro en journalpump que registra la configuraci\u00f3n de una integraci\u00f3n de servicios en texto plano en la canalizaci\u00f3n de registro proporcionada, incluida la informaci\u00f3n de credenciales contenida en la configuraci\u00f3n, si corresponde. El problema se solucion\u00f3 en journalpump 2.5.0."}], "id": "CVE-2023-51390", "lastModified": "2024-11-21T08:38:00.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-21T00:15:26.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-215"}, {"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}