CVE-2020-10750 Information Exposure in jaeger
Attackers with log access can discover Kafka credentials in Jaeger when using the Kafka data store, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10750?
CVE-2020-10750 is a high-severity vulnerability in the Jager project jaegertracing/jaeger, published on 19 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
Which versions are affected by CVE-2020-10750?
4 open source packages ship an affected version, including github.com/jaegertracing/jaeger and jaeger. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jaegertracing/jaeger Go | All versions | 1.18.1 |
github.com/jaegertracing/jaeger Go | All versions | 1.18.1 |
github.com/jaegertracing/jaeger Go | All versions | 1.18.1 |
jaeger Bitnami | All versions | 1.18.1 |
Products include Linuxfoundation Jaeger.
How do I fix CVE-2020-10750?
Upgrade github.com/jaegertracing/jaeger to 1.18.1 or later.
Is CVE-2020-10750 being exploited?
There is no known exploitation of CVE-2020-10750 in the wild and no public exploit code.
Sources
Also known as BIT-jaeger-2020-10750, GHSA-gh32-pc56-4c96, GO-2022-0834.