CVE-2023-51390

Information Disclosure Vulnerability in Journalpump

State: Published
Severity: 6.5 Medium
Published: Dec 20, 2023
Updated: Aug 2, 2024
Reserved: Dec 18, 2023

Description

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-284 Improper Access Control
CWE-215 Insertion of Sensitive Information Into Debugging Code

Affected Products

Product	Versions
journalpumpAiven-Open	< 2.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.