GHSA-3j6g-hxx5-3q26MediumCVSS 5.9

Observable Discrepancy in Apache Kafka

Published
September 23, 2021
Last Modified
September 5, 2023

🔗 CVE IDs covered (1)

CVE-2021-38153 →

📋 Description

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

🎯 Affected products10

  • maven/org.apache.kafka:kafka_2.11:>= 2.0.0, <= 2.4.1
  • maven/org.apache.kafka:kafka_2.12:>= 2.0.0, < 2.6.3
  • maven/org.apache.kafka:kafka_2.12:>= 2.7.0, < 2.7.2
  • maven/org.apache.kafka:kafka_2.12:= 2.8.0
  • maven/org.apache.kafka:kafka_2.13:>= 2.4.0, < 2.6.3
  • maven/org.apache.kafka:kafka_2.13:>= 2.7.0, < 2.7.2
  • maven/org.apache.kafka:kafka_2.13:= 2.8.0
  • maven/org.apache.kafka:kafka-clients:>= 2.0.0, < 2.6.3
  • maven/org.apache.kafka:kafka-clients:>= 2.7.0, < 2.7.2
  • maven/org.apache.kafka:kafka-clients:= 2.8.0

🔗 References (14)