Description
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Kafka | 0.11.0.0 to 2.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kafka:kafka | >= 0.11.0.0, < 2.1.1 | 2.1.1 | GHSA-47w3-66wq-cpxg |
Advisories 1
- WID-SEC-2023-1048 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2024
References
- 109139 vdb-entry
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223) mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250) mailing-list
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.mail-archive.com/dev%40kafka.apache.org/msg99277.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [flink-user] 20210703 Re: owasp-dependency-check is flagging flink 1.13 for scala 2.12.7 mailing-list