org.apache.kafka:kafka_2.12

2 results · Clear filters · Feed

• Medium 5.3
  CVE-2024-56128

  Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

  Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1…

  Apache Software Foundation Apache Kafka strimzi-kafka-operator-kafka-thirdparty-libs-cc strimzi-kafka-operator-kafka-init Wolfi Maven
  Dec 18, 2024
• Medium 5.9
  CVE-2021-38153

  Timing Attack Vulnerability for Apache Kafka Connect and Clients

  Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or high…

  Apache Software Foundation Apache Kafka kafka org.apache.kafka:kafka-clients Ubuntu Maven
  Sep 22, 2021