CVE-2019-12399

Published: Jan 14, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Affected (27)

Products: Apache: Kafka · Oracle: Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Liquidity Management, Banking Payments, Banking Platform, Banking Supply Chain Finance, Banking Trade Finance Process Management, Banking Virtual Account Management, Blockchain Platform, Communications Cloud Native Core Policy, Financial Services Analytical Applications Infrastructure, Flexcube Universal Banking

Apache

1 product

Kafka

Oracle

12 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Liquidity Management

Banking Payments

Banking Platform

Banking Supply Chain Finance

Banking Trade Finance Process Management

Banking Virtual Account Management

Blockchain Platform

Communications Cloud Native Core Policy

Financial Services Analytical Applications Infrastructure

Flexcube Universal Banking

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Apache Kafka	Version 2.0.0
Apache Kafka	Version 2.0.1
Apache Kafka	Version 2.1.0
Apache Kafka	Version 2.1.1
Apache Kafka	Version 2.2.0
Apache Kafka	Version 2.2.1
Apache Kafka	Version 2.3.0

Configuration B

20 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.1.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.4.0
Oracle Banking Credit Facilities Process Management	Version 14.1.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.4.0
Oracle Banking Liquidity Management	From 14.0.0 to 14.4.0
Oracle Banking Payments	Version 14.4.0
Oracle Banking Platform	Version 2.7.0
Oracle Banking Supply Chain Finance	From 14.2.0 to 14.4.0
Oracle Banking Trade Finance Process Management	Version 14.1.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.4.0
Oracle Banking Virtual Account Management	Version 14.1.0
Oracle Banking Virtual Account Management	Version 14.3.0
Oracle Banking Virtual Account Management	Version 14.4.0
Oracle Blockchain Platform	Before 21.1.2
Oracle Communications Cloud Native Core Policy	Version 1.9.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.1.0
Oracle Flexcube Universal Banking	Version 14.4.0

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (48)

http://www.openwall.com/lists/oss-security/2020/01/14/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r0e3a613705d70950aca2bfe9a6265c87503921852d9a3dbce512ca9f%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3154f5adbc905f1f9012a92240c8e00a96628470cc819453b9606d0e%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76dc2b7a8%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r47c225db363d1ee2c18c4b3b2f51b63a9789f78c7fa602e5976ecd05%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4b20b40c40d4a4c641e2ef4228098a57935e5782bfdfdf3650e48265%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4d9e87cdae99e98d7b244cfa53d9d2532d368d3a187fbc87c493dcbe%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r56eb055b544931451283fee51f7e1f5b8ebd3085fed7d77aaba504c9%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cdev.kafka.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9%40%3Cusers.kafka.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6fa1cff4786dcef2ddd1d717836ef123c878e8321c24855bad24ae0f%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r801c68bf987931f35d2e24ecc99f3aa2850fdd8f5ef15fe6c60fecf3%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9871a4215b621c1d09deee5eba97f0f44fde01b4363deb1bed0dd160%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f342dfa845e0261%40%3Ccommits.kafka.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rda253155601968331b5cf0da4f273813bbd91843c2568a8495d1c662%40%3Ccommits.kafka.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rde947ee866de6687bc51cdc8dfa6d7e6b3ad4ce8c708c344f773e6dc%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfe90ca0463c199b99c2921410639aed53a172ea8b733eab0dc776262%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2020/01/14/1