~ / search / GHSA-3j6g-hxx5-3q26

GHSA-3j6g-hxx5-3q26

Observable Discrepancy in Apache Kafka

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-38153

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kafka:kafka_2.11 >= 2.0.0, <= 2.4.1 no fix listed
Maven org.apache.kafka:kafka_2.12 >= 2.0.0, < 2.6.3 2.6.3
Maven org.apache.kafka:kafka_2.12 >= 2.7.0, < 2.7.2 2.7.2
Maven org.apache.kafka:kafka_2.12 >= 2.8.0, < 2.8.1 2.8.1
Maven org.apache.kafka:kafka_2.13 >= 2.4.0, < 2.6.3 2.6.3
Maven org.apache.kafka:kafka_2.13 >= 2.7.0, < 2.7.2 2.7.2
Maven org.apache.kafka:kafka_2.13 >= 2.8.0, < 2.8.1 2.8.1
Maven org.apache.kafka:kafka-clients >= 2.0.0, < 2.6.3 2.6.3
Maven org.apache.kafka:kafka-clients >= 2.7.0, < 2.7.2 2.7.2
Maven org.apache.kafka:kafka-clients >= 2.8.0, < 2.8.1 2.8.1

Details

As written in the advisory (Markdown source, shown as plain text).

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

References

External links from the advisory. They lead to third-party sites.