~ / search / GHSA-gh27-38p5-mrxc

GHSA-gh27-38p5-mrxc

Improper Control of Generation of Code in Apache Kafka

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1288

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kafka:kafka >= 0.9.0.0, < 0.10.2.2 0.10.2.2
Maven org.apache.kafka:kafka >= 0.11.0.0, < 0.11.0.3 0.11.0.3
Maven org.apache.kafka:kafka >= 1.0.0, < 1.0.1 1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

References

External links from the advisory. They lead to third-party sites.