Amazon Kinesis Producer
Monthly
Amazon Kinesis Producer Library for Java (KPL) 1.0.7 and earlier exposes the AWS credentials it resolves for the application to other accounts on the same host: the library hands those credentials to its native child process as command-line arguments, where any local user can read them from the process argument list, and when the Daemon logger runs at DEBUG it also writes them into the application log in hex-encoded form. Exploitation is strictly local and requires an existing account on the host (CVSS v3.1 AV:L/PR:L, vendor score 8.2), and no public exploit code was identified at time of analysis; the argument-list exposure applies to default configurations and cannot be configured away, while the log exposure is limited to DEBUG-level Daemon logging. AWS has released KPL 1.0.8, which sends credentials over IPC instead of the command line and changes the native-process debug logging, and recommends rotating any long-lived IAM keys and revoking active role sessions that may have been disclosed.
Amazon Kinesis Producer Library for Java (KPL) 1.0.7 and earlier exposes the AWS credentials it resolves for the application to other accounts on the same host: the library hands those credentials to its native child process as command-line arguments, where any local user can read them from the process argument list, and when the Daemon logger runs at DEBUG it also writes them into the application log in hex-encoded form. Exploitation is strictly local and requires an existing account on the host (CVSS v3.1 AV:L/PR:L, vendor score 8.2), and no public exploit code was identified at time of analysis; the argument-list exposure applies to default configurations and cannot be configured away, while the log exposure is limited to DEBUG-level Daemon logging. AWS has released KPL 1.0.8, which sends credentials over IPC instead of the command line and changes the native-process debug logging, and recommends rotating any long-lived IAM keys and revoking active role sessions that may have been disclosed.