GitHub Advisoryadvisory · Maven

GHSA-xm78-4m3g-7wm7 Improper Authentication in Apache Kafka

MEDIUM Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-12610
Ecosystem
Maven
Packages
org.apache.kafka:kafka-clients
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287
Reviewed
2022-07-01

Affected packages

• Maven org.apache.kafka:kafka-clients: >= 0.10.0.0, < 0.10.2.2 → fixed in 0.10.2.2 • Maven org.apache.kafka:kafka-clients: >= 0.11.0.0, < 0.11.0.2 → fixed in 0.11.0.2

Description

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

Related

Alias · CVE (1)

  • CVE-2017-12610 In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References