Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.

To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• aws.amazon.com/security/security-bulletins/2026-159-aws Üretici bülteni
• github.com/…bs/amazon-kinesis-producer/releases/tag/v1.0.8 Yama
• github.com/…oducer/security/advisories/GHSA-mr97-jq69-qr5f Üçüncü taraf

Kayıt geçmişi

1. 30 Eki 2026 21:05Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-62347Element Call exposes shared passwords in logs
• 6,5 CVE-2026-116246pgAdmin 4: Server passwords are left in pgAdmin's process environment
• 7,5 CVE-2026-119290Zuke: Çözümlenmiş secret değerleri GITHUB_STEP_SUMMARY dosyasına açık metin olarak yazılıyor
• 6,5 CVE-2026-59388Cloud Controller exposes secrets in audit log
• 6,6 CVE-2026-90861Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
• 8,2 CVE-2026-118647n8n SeaTable Trigger düğümünde API token'ının hata yürütme verilerinde açığa çıkması