Published: 22/09/2021 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache kafka
apache kafka 2.8.0
quarkus quarkus
oracle primavera unifier 18.8
oracle primavera unifier 19.12
oracle primavera unifier 20.12
oracle primavera unifier 21.12
oracle financial services enterprise case management 8.0.8.1
oracle financial services enterprise case management 8.1.1.0
oracle financial services enterprise case management 8.1.1.1
oracle financial services behavior detection platform 8.1.2.0
oracle financial services behavior detection platform 8.1.1.1
oracle financial services behavior detection platform 8.1.1.0
oracle financial services enterprise case management 8.0.7.1
oracle financial services enterprise case management 8.0.8.0
oracle financial services behavior detection platform
oracle communications cloud native core policy 1.15.0
oracle financial services enterprise case management 8.0.7.2
oracle financial services analytical applications infrastructure
oracle communications brm - elastic charging engine 12.0.0.5.0
oracle communications brm - elastic charging engine

Synopsis Moderate: Red Hat Integration Camel Extensions for Quarkus 27 security update Type/Severity Security Advisory: Moderate Topic Red Hat Integration Camel Extensions for Quarkus 27 is now available The purpose of this text-only errata is to inform you about the security issues fixedRed Hat Product Security has rated this update as h ...

Synopsis Moderate: Red Hat build of Eclipse Vertx 425 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of Eclipse VertxRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a d ...

Synopsis Moderate: Red Hat Integration - Service Registry release and security update [203GA] Type/Severity Security Advisory: Moderate Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues f ...

Synopsis Moderate: Red Hat Integration Camel-K 18 security update Type/Severity Security Advisory: Moderate Topic A minor version update is now available for Red Hat Integration Camel K The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update as havi ...

Synopsis Moderate: Red Hat build of Quarkus 225 release and security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of QuarkusRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...

Synopsis Moderate: Red Hat Data Grid 831 security update Type/Severity Security Advisory: Moderate Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is ...

Synopsis Important: Red Hat Fuse 7110 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 710 to 711) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...

Some components in Apache Kafka use `Arraysequals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful Users should upgrade to 281 or higher, or 300 or higher where this vulnerability has been fixed The affected versions include Apache Kafka 20 ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2021-38153: Timing Attack Vulnerability for Apache Kafka Connect and Clients  <!--X-Head-of-Mes ...

CWE-203 https://kafka.apache.org/cve-list https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2022:5606

CVE-2021-38153

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect