GitHub Advisoryadvisory · Maven

GHSA-47w3-66wq-cpxg Improper Input Validation in Apache Kafka

HIGH Published 2022-05-24 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-17196
Ecosystem
Maven
Packages
org.apache.kafka:kafka
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-06-29

Affected packages

• Maven org.apache.kafka:kafka: >= 0.11.0.0, < 2.1.1 → fixed in 2.1.1

Description

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.

Related

Alias · CVE (1)

  • CVE-2018-17196 In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References