You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Chia-Ping Tsai (Jira)" <ji...@apache.org> on 2025/02/27 22:36:00 UTC
[jira] [Updated] (KAFKA-18371) TopicBasedRemoteLogMetadataManagerConfig exposes sensitive configuration data in logs
[ https://issues.apache.org/jira/browse/KAFKA-18371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chia-Ping Tsai updated KAFKA-18371:
-----------------------------------
Fix Version/s: 4.1.0
(was: 4.1)
> TopicBasedRemoteLogMetadataManagerConfig exposes sensitive configuration data in logs
> -------------------------------------------------------------------------------------
>
> Key: KAFKA-18371
> URL: https://issues.apache.org/jira/browse/KAFKA-18371
> Project: Kafka
> Issue Type: Bug
> Components: core
> Affects Versions: 3.1.0
> Reporter: Vadym Zhytkevych
> Assignee: Vadym Zhytkevych
> Priority: Major
> Labels: storage, tiered-storage
> Fix For: 4.1.0
>
>
> {code:java}
> [2024-12-20 14:52:56,805] INFO Successfully configured topic-based RLMM with config: TopicBasedRemoteLogMetadataManagerConfig{clientIdPrefix='__remote_log_metadata_client_6', metadataTopicPartitionsCount=50, consumeWaitMs=120000, metadataTopicRetentionMs=-1, metadataTopicReplicationFactor=3, initializationRetryMaxTimeoutMs=120000, initializationRetryIntervalMs=100, commonProps={request.timeout.ms=10000, ssl.client.auth=none, ssl.keystore.location=/etc/kafka/ssl/keystore.p12, bootstrap.servers=server1:9094, security.protocol=SASL_SSL, password=CLEARTEXT, ssl.truststore.location=/etc/pki/java/cacerts, ssl.keystore.password=CLEARTEXT, sasl.mechanism=SCRAM-SHA-512, ssl.key.password=CLEARTEXT, sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="username" password="CLEARTEXT";, ssl.truststore.password=CLEARTEXT, …{code}
>
> Issue is related to using toString() method of TopicBasedRemoteLogMetadataManagerConfig, that prints maps of consumerProps and producerProps without masking.
>
> Current workaround: logger for class TopicBasedRemoteLogMetadataManagerConfig can be disabled to not expose sensitive data.
> Expected behavior: sensitive configuration data masked automatically in logs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)