GitHub Advisoryadvisory · Maven

GHSA-gh27-38p5-mrxc Improper Control of Generation of Code in Apache Kafka

MEDIUM Published 2022-05-13 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-1288
Ecosystem
Maven
Packages
org.apache.kafka:kafka
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-94
Reviewed
2022-06-29

Affected packages

• Maven org.apache.kafka:kafka: >= 0.9.0.0, < 0.10.2.2 → fixed in 0.10.2.2 • Maven org.apache.kafka:kafka: >= 0.11.0.0, < 0.11.0.3 → fixed in 0.11.0.3 • Maven org.apache.kafka:kafka: >= 1.0.0, < 1.0.1 → fixed in 1.0.1

Description

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

Related

Alias · CVE (1)

  • CVE-2018-1288 In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References