Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact
5.9
CVSSv3

CVE-2021-38153

CVSSv4: NA | CVSSv3: 5.9 | CVSSv2: 4.3 | VMScore: 690 | EPSS: 0.00104 | KEV: Not Included
Published: 22/09/2021 Updated: 21/11/2024

Vulnerability Summary

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache kafka

apache kafka 2.8.0

quarkus quarkus

oracle communications brm - elastic charging engine

oracle communications brm - elastic charging engine 12.0.0.5.0

oracle communications cloud native core policy 1.15.0

oracle financial services analytical applications infrastructure

oracle financial services behavior detection platform

oracle financial services behavior detection platform 8.1.1.0

oracle financial services behavior detection platform 8.1.1.1

oracle financial services behavior detection platform 8.1.2.0

oracle financial services enterprise case management 8.0.7.1

oracle financial services enterprise case management 8.0.7.2

oracle financial services enterprise case management 8.0.8.0

oracle financial services enterprise case management 8.0.8.1

oracle financial services enterprise case management 8.1.1.0

oracle financial services enterprise case management 8.1.1.1

oracle primavera unifier 18.8

oracle primavera unifier 19.12

oracle primavera unifier 20.12

oracle primavera unifier 21.12

Vendor Advisories

Red Hat: Moderate: Red Hat build of Eclipse Vert.x 4.2.5 security update
Synopsis Moderate: Red Hat build of Eclipse Vertx 425 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of Eclipse VertxRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a d ...
Red Hat: Moderate: Red Hat Integration - Service Registry release and security update [2.0.3.GA]
Synopsis Moderate: Red Hat Integration - Service Registry release and security update [203GA] Type/Severity Security Advisory: Moderate Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues f ...
Red Hat: Moderate: Red Hat build of Quarkus 2.2.5 release and security update
Synopsis Moderate: Red Hat build of Quarkus 225 release and security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of QuarkusRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...
Red Hat: Moderate: Red Hat Integration Camel Extensions for Quarkus 2.7 security update
Synopsis Moderate: Red Hat Integration Camel Extensions for Quarkus 27 security update Type/Severity Security Advisory: Moderate Topic Red Hat Integration Camel Extensions for Quarkus 27 is now available The purpose of this text-only errata is to inform you about the security issues fixedRed Hat Product Security has rated this update as h ...
Red Hat: Moderate: Red Hat Data Grid 8.3.1 security update
Synopsis Moderate: Red Hat Data Grid 831 security update Type/Severity Security Advisory: Moderate Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is ...
Red Hat: Moderate: Red Hat Integration Camel-K 1.8 security update
Synopsis Moderate: Red Hat Integration Camel-K 18 security update Type/Severity Security Advisory: Moderate Topic A minor version update is now available for Red Hat Integration Camel K The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update as havi ...
Red Hat: Important: Red Hat Fuse 7.11.0 release and security update
Synopsis Important: Red Hat Fuse 7110 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 710 to 711) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...
Red Hat: CVE-2021-38153
Some components in Apache Kafka use `Arraysequals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful Users should upgrade to 281 or higher, or 300 or higher where this vulnerability has been fixed The affected versions include Apache Kafka 20 ...

Mailing Lists

Full Disclosure: CVE-2021-38153: Timing Attack Vulnerability for Apache Kafka Connect and Clients
Severity: moderate Description: Some components in Apache Kafka use `Arraysequals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful Users should upgrade to 281 or higher, or 300 or higher where this vulnerability has been fixed The affecte ...

References

CWE-203CWE-203https://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2022:0737https://www.first.org/epsshttps://kafka.apache.org/cve-listhttps://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://kafka.apache.org/cve-listhttps://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
Preferred Score:
CVSSv3
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2025-2308typo3CVE-2025-29387CVE-2024-12019cache poisoningCVE-2025-24472fortinacunspecifiedspringboot-openai-chatgptbypassCVE-2024-55591CVE-2025-1624tianocore
Home
/
Search Results
/
CVE-2021-38153
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook