Description
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka | 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kafka:kafka-clients | >= 0.10.0.0, < 0.10.2.2 | 0.10.2.2 | GHSA-xm78-4m3g-7wm7 |
| Maven | org.apache.kafka:kafka-clients | >= 0.11.0.0, < 0.11.0.2 | 0.11.0.2 | GHSA-xm78-4m3g-7wm7 |
References
- [kafka-users] 20180726 CVE-2017-12610: Authenticated Kafka clients may impersonate other users mailing-list
- 104899 vdb-entry
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html