~ / search / GHSA-xm78-4m3g-7wm7

GHSA-xm78-4m3g-7wm7

Improper Authentication in Apache Kafka

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-12610

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kafka:kafka-clients >= 0.10.0.0, < 0.10.2.2 0.10.2.2
Maven org.apache.kafka:kafka-clients >= 0.11.0.0, < 0.11.0.2 0.11.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

References

External links from the advisory. They lead to third-party sites.