CVE-2023-30450 Misconfiguration in n/a

Medium 4.3 Published 8 Apr 2023 Updated 12 Feb 2025

Redpanda mishandles TLS configuration fields, potentially leaving broker RPC ports unencrypted unless manually reconfigured while the cluster is offline.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-30450?

CVE-2023-30450 is a medium-severity vulnerability in n/a, published on 8 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches.

Weakness: CWE-20

Which versions are affected by CVE-2023-30450?

It affects 1 product.

Products include Redpanda Redpanda.

How do I fix CVE-2023-30450?

No fix has been published for CVE-2023-30450 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-30450 being exploited?

There is no known exploitation of CVE-2023-30450 in the wild and no public exploit code.

Sources

Also known as GHSA-x3pf-j9xx-29g6.