Description
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka | 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | kafka | 0.10.2.2-5.6.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud 8 | ardana-monasca | 8.0+git.1535031421.9262a47-3.12.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud 8 | ardana-spark | 8.0+git.1534267176.a5f3a22-3.6.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud 8 | kafka | 0.10.2.2-5.6.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 | SUSE-SU-2018:3563-1 |
| SUSE OpenStack Cloud 7 | grafana | 4.5.1-1.8.1 | SUSE-SU-2018:2536-1 |
| SUSE OpenStack Cloud 7 | kafka | 0.10.2.2-5.1 | SUSE-SU-2018:2536-1 |
| SUSE OpenStack Cloud 7 | logstash | 2.4.1-5.1 | SUSE-SU-2018:2536-1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20180608_12.47-9.1 | SUSE-SU-2018:2536-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE HPE Helion OpenStack 8 | ardana-monasca | 8.0+git.1535031421.9262a47-3.12.1 | SUSE-SU-2018:3563-1 |
| SUSE HPE Helion OpenStack 8 | ardana-spark | 8.0+git.1534267176.a5f3a22-3.6.1 | SUSE-SU-2018:3563-1 |
| SUSE HPE Helion OpenStack 8 | kafka | 0.10.2.2-5.6.1 | SUSE-SU-2018:3563-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 | SUSE-SU-2018:3563-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kafka-source | 2.1.0-3.6 | openSUSE-SU-2024:10886-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kafka:kafka | >= 0.9.0.0, < 0.10.2.2 | 0.10.2.2 | GHSA-gh27-38p5-mrxc |
| Maven | org.apache.kafka:kafka | >= 0.11.0.0, < 0.11.0.3 | 0.11.0.3 | GHSA-gh27-38p5-mrxc |
| Maven | org.apache.kafka:kafka | >= 1.0.0, < 1.0.1 | 1.0.1 | GHSA-gh27-38p5-mrxc |
Advisories 3
- SUSE-SU-2018:2536-1 Security update for grafana, kafka, logstash and monasca-installer SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10886-1 kafka-source-2.1.0-3.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3563-1 Security update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [kafka-users] 20180726 CVE-2018-1288: Authenticated Kafka clients may interfere with data replication mailing-list
- 104900 vdb-entry
- RHSA-2018:3768 vendor-advisory
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223) mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [flink-issues] 20200402 [GitHub] [flink] zentol opened a new pull request #11617: [FLINK-16389][kafka] Bump kafka version to 0.10.2.2 mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- [kafka-dev] 20211007 Re: CVE Back Port? mailing-list