apache kafka vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv2

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

Apache Storm

6.8

CVSSv2

The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability...

Tibco Messaging - Apache Kafka Distribution - Schema Repository 1.0.0

6.5

CVSSv2

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users sh...

Apache Kafka

1 Github repository

5.8

CVSSv2

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request ...

5

CVSSv2

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration ...

Apache Kafka 2.0.1 Apache Kafka 2.1.1 Apache Kafka 2.2.0 Apache Kafka 2.2.1 Apache Kafka 2.3.0 Apache Kafka 2.0.0 Apache Kafka 2.1.0 Oracle Financial Services Analytical Applications Infrastructure Oracle Banking Platform 2.7.0 Oracle Flexcube Universal Banking 14.4.0 Oracle Banking Virtual Account Management 14.1.0 Oracle Banking Virtual Account Management 14.3.0 Oracle Banking Virtual Account Management 14.4.0 Oracle Banking Trade Finance Process Management 14.1.0 Oracle Banking Trade Finance Process Management 14.3.0 Oracle Banking Trade Finance Process Management 14.4.0 Oracle Banking Supply Chain Finance Oracle Banking Liquidity Management Oracle Banking Credit Facilities Process Management 14.1.0 Oracle Banking Credit Facilities Process Management 14.3.0 Oracle Banking Credit Facilities Process Management 14.4.0 Oracle Banking Corporate Lending Process Management 14.3.0

4.9

CVSSv2

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

Apache Kafka

1 Github repository

4.3

CVSSv2

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnera...

Apache Kafka Apache Kafka 2.8.0 Quarkus Quarkus Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 19.12 Oracle Primavera Unifier 20.12 Oracle Primavera Unifier 21.12 Oracle Financial Services Enterprise Case Management 8.0.8.1 Oracle Financial Services Enterprise Case Management 8.1.1.0 Oracle Financial Services Enterprise Case Management 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.2.0 Oracle Financial Services Behavior Detection Platform 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.1.0 Oracle Financial Services Enterprise Case Management 8.0.7.1 Oracle Financial Services Enterprise Case Management 8.0.8.0 Oracle Financial Services Behavior Detection Platform Oracle Communications Cloud Native Core Policy 1.15.0 Oracle Financial Services Enterprise Case Management 8.0.7.2 Oracle Financial Services Analytical Applications Infrastructure Oracle Communications Brm - Elastic Charging Engine 12.0.0.5.0 Oracle Communications Brm - Elastic Charging Engine

NA

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL con...

NA

Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka (as consumer and producer).

Prolion Cryptospike 3.0.15

NA

In Spring for Apache Kafka 3.0.9 and previous versions and versions 2.9.10 and previous versions, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deser...

Vmware Spring For Apache Kafka

2 Github repositories

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook